CVE-2026-64376 Overview
CVE-2026-64376 is a device reference count leak in the Linux kernel firmware_loader subsystem. The flaw resides in firmware_upload_register(), where the failure path incorrectly frees the fw_sysfs instance directly instead of releasing the embedded struct device reference via put_device(). Because fw_create_instance() already invokes device_initialize(), subsequent lifetime management must go through the device core reference counting. Bypassing this leaves the reference count unbalanced, producing a memory leak each time alloc_lookup_fw_priv() fails after a successful fw_create_instance() call.
Critical Impact
The unbalanced reference count in firmware_upload_register() results in a kernel memory leak that can degrade system stability over repeated failure conditions.
Affected Products
- Linux kernel (mainline) — drivers/base/firmware_loader/ subsystem
- Linux stable branches referenced by upstream fix commits
- Distributions shipping unpatched versions of the affected firmware loader code
Discovery Timeline
- 2026-07-25 - CVE-2026-64376 published to NVD
- 2026-07-25 - Last updated in NVD database
Technical Details for CVE-2026-64376
Vulnerability Analysis
The vulnerability lives in the Linux kernel firmware loader, specifically in firmware_upload_register(). The call chain firmware_upload_register() -> fw_create_instance() -> device_initialize() establishes a reference-counted struct device embedded in fw_sysfs. Once device_initialize() runs, the device's lifetime must be managed exclusively through the device core, meaning cleanup requires put_device() rather than direct deallocation of the containing structure.
When alloc_lookup_fw_priv() fails after fw_create_instance() succeeds, control flow jumps to the free_fw_sysfs label. That path frees fw_sysfs directly. The embedded device's reference count is never decremented, and fw_dev_release() is never invoked. The result is a refcount leak and associated memory leak on every failed registration.
Root Cause
The root cause is inconsistent object lifetime management. The code mixes manual deallocation with the device core's reference-counted release model. Because device_initialize() transfers ownership to the driver core, any direct kfree() on the embedding structure violates the contract [CWE-401: Missing Release of Memory after Effective Lifetime].
Attack Vector
This is a local reliability defect rather than a remotely exploitable flaw. Triggering the leak requires reaching the failure branch of firmware_upload_register(), which depends on memory pressure or other kernel-internal allocation failures. The impact is cumulative resource exhaustion in long-running systems that repeatedly register firmware upload interfaces under adverse conditions.
No public exploit or exploitation code is available. The vulnerability was identified through static analysis and confirmed by manual review, according to the upstream commit message. See the upstream fixes in Linux Kernel Commit 15432f19562f and Linux Kernel Commit 46d403da37 for the corrected error-path handling.
Detection Methods for CVE-2026-64376
Indicators of Compromise
- Gradual, unexplained growth of kernel slab memory associated with device objects on systems that repeatedly invoke firmware upload registration.
- Kernel warnings referencing unbalanced device reference counts under drivers/base/firmware_loader/.
- Failed firmware upload registrations logged alongside rising kmalloc-* slab consumption in /proc/slabinfo.
Detection Strategies
- Compare the running kernel version against the fixed commits listed in the vendor advisory references to determine exposure.
- Enable CONFIG_DEBUG_KOBJECT_RELEASE and CONFIG_KMEMLEAK in test builds to surface unbalanced device reference releases during regression testing.
- Correlate dmesg output with firmware upload subsystem activity to identify repeated allocation failures downstream of fw_create_instance().
Monitoring Recommendations
- Track kernel memory metrics (MemAvailable, slab usage) over time on hosts that expose firmware upload interfaces to userspace.
- Alert on repeated non-zero return codes from firmware upload registration in vendor driver logs.
- Include kernel package versions in configuration management inventory to accelerate identification of unpatched hosts.
How to Mitigate CVE-2026-64376
Immediate Actions Required
- Identify Linux hosts running kernel versions predating the upstream fix commits and prioritize patching on systems that use the firmware upload interface.
- Apply distribution vendor kernel updates that incorporate the referenced stable commits.
- Restrict access to interfaces that trigger firmware_upload_register() where feasible, limiting exposure to trusted management planes.
Patch Information
The fix replaces the direct free in the error path with put_device(fw_dev), delegating cleanup to fw_dev_release(). Patches are available across multiple stable branches. Refer to Linux Kernel Commit 15432f19562f, Linux Kernel Commit 2619b47a0c, Linux Kernel Commit 46d403da37, Linux Kernel Commit 517676ec7d, Linux Kernel Commit 896df22ee5, and Linux Kernel Commit 92f41769e5.
Workarounds
- Disable or unload kernel modules that rely on firmware_upload_register() if the functionality is not required for host operations.
- Schedule periodic reboots on affected hosts to reclaim leaked kernel memory until patches are deployed.
- Monitor firmware upload registration failures and correlate with slab growth to detect leak accumulation early.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
