CVE-2026-68331: Linux Kernel Privilege Escalation Flaw

CVE-2026-68331 Overview

CVE-2026-68331 is a reference count leak in the Linux kernel's dpaa2-eth Ethernet driver for NXP DPAA2 (Data Path Acceleration Architecture v2) hardware. The fsl_mc_get_endpoint() function returns the MAC endpoint device with a reference taken through device_find_child(). The connect path stores that device in mac->mc_dev, but the disconnect path frees the dpaa2_mac object without dropping the endpoint device reference. Every successful connect leaks a device reference when the MAC is later disconnected. The fix drops the reference after closing the MAC and before freeing the dpaa2_mac object.

Critical Impact
Repeated MAC connect and disconnect cycles slowly exhaust kernel struct device references, contributing to memory pressure and preventing clean teardown of DPAA2 network resources.

Affected Products

Linux kernel builds compiled with the dpaa2-eth driver (NXP DPAA2 Ethernet)
Systems using Freescale Management Complex (fsl_mc) bus infrastructure
Distributions shipping affected stable kernel branches prior to the referenced fix commits

Discovery Timeline

2026-08-10 - CVE-2026-68331 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68331

Vulnerability Analysis

The vulnerability resides in the DPAA2 Ethernet driver's MAC endpoint handling logic. When an Ethernet DPNI (Data Path Network Interface) object connects to a MAC, the driver calls fsl_mc_get_endpoint() to locate the peer MAC device on the fsl_mc bus. That helper wraps device_find_child(), which increments the reference count on the returned struct device before returning it to the caller.

The driver stores the returned pointer in mac->mc_dev and retains it across the lifetime of the connection. During disconnect, the driver correctly closes the MAC object and frees the surrounding dpaa2_mac structure. However, it never calls put_device() on mac->mc_dev, so the reference obtained at connect time is never balanced.

Each connect and disconnect cycle therefore leaks one struct device reference. Over time, this prevents the underlying device object from being released and contributes to kernel memory growth on systems that reconfigure DPAA2 networking dynamically.

Root Cause

The root cause is a missing put_device() call in the disconnect path of the dpaa2-eth driver. The connect path acquires a device reference through device_find_child() semantics but the teardown path does not release it. This is a resource management defect [CWE-772: Missing Release of Resource after Effective Lifetime].

Attack Vector

Exploitation requires local privileges sufficient to trigger repeated MAC connect and disconnect operations against DPAA2 network devices. There is no remote attack vector. The impact is limited to resource leakage rather than memory corruption or privilege escalation. Sustained abuse could contribute to a denial-of-service condition on long-running systems, but practical exploitation is constrained to environments running affected NXP hardware.

See the upstream fix at kernel.org commit f112df0744e2 for the corrected teardown sequence.

Detection Methods for CVE-2026-68331

Indicators of Compromise

Growth in kernel struct device allocations tied to the fsl_mc bus over extended uptime
Increasing kernel memory usage on DPAA2-equipped systems that repeatedly reconfigure Ethernet endpoints
dpaa2_mac teardown events in kernel logs without corresponding endpoint device release traces

Detection Strategies

Inventory Linux hosts running kernels that include the dpaa2-eth driver and confirm patch level against the stable commits listed in the NVD entry
Use kmemleak or kernel tracing on device_find_child and put_device call pairs when validating vendor kernels on DPAA2 hardware
Correlate long-lived NXP LS-series or DPAA2 platforms with kernel memory telemetry to spot slow, monotonic growth

Monitoring Recommendations

Collect kernel version and package inventory across Linux fleets and flag hosts missing the fix commits
Monitor for anomalous kernel memory consumption on embedded and networking platforms using DPAA2
Alert on repeated dpni connect and disconnect events that could accelerate the leak

How to Mitigate CVE-2026-68331

Immediate Actions Required

Identify systems running the dpaa2-eth driver, typically NXP Layerscape and QorIQ networking platforms
Apply vendor kernel updates that include the upstream fix commits referenced in the NVD entry
Restrict local access to interfaces that trigger DPNI to MAC connect and disconnect operations until patched

Patch Information

The fix drops the endpoint device reference after closing the MAC and before freeing the dpaa2_mac object. The corrected code paths are available in the following stable kernel commits: 915012e92331, a3cecf169cc6, b4b201cc93ff, e23e4a3b9dfd, and f112df0744e2.

Workarounds

Avoid dynamic reconfiguration of DPAA2 MAC endpoints on unpatched kernels to minimize accumulated leaks
Schedule periodic reboots on long-running unpatched systems to reclaim leaked device references
Where DPAA2 networking is not required, disable the dpaa2-eth module until the patched kernel is deployed

bash

# Verify running kernel and check for the dpaa2-eth module
uname -r
lsmod | grep dpaa2_eth

# Confirm patched commit is present in the source tree (example)
git -C /usr/src/linux log --oneline | grep -E 'dpaa2-eth.*put MAC endpoint'