CVE-2026-68333 Overview
CVE-2026-68333 is a resource management flaw in the Linux kernel's dpaa2-switch driver. The disconnect path fails to release a MAC endpoint device reference obtained via fsl_mc_get_endpoint(), which internally calls device_find_child(). Each successful connect operation leaks a device reference when the associated MAC is later disconnected. Over time, repeated connect and disconnect cycles accumulate references that prevent proper device teardown. The issue has been resolved upstream by dropping the endpoint device reference before freeing the dpaa2_mac object.
Critical Impact
Repeated connect and disconnect operations on a dpaa2-switch port progressively leak MAC endpoint device references, degrading kernel resource management on affected NXP DPAA2-based Linux systems.
Affected Products
- Linux kernel with the dpaa2-switch driver enabled (NXP DPAA2 platforms)
- Stable kernel branches prior to the fix commits referenced below
- Distributions shipping vulnerable stable kernels
Discovery Timeline
- 2026-08-10 - CVE-2026-68333 published to NVD
- 2026-08-10 - Last updated in NVD database
Technical Details for CVE-2026-68333
Vulnerability Analysis
The flaw resides in the Data Path Acceleration Architecture 2 (dpaa2) Ethernet switch driver. During switch port connect, fsl_mc_get_endpoint() returns the MAC endpoint device with an elevated reference count taken through device_find_child(). The connect path stores this pointer in mac->mc_dev and retains it for the lifetime of the connected MAC object.
The disconnect path closes the MAC and frees the dpaa2_mac object, but never invokes put_device() on mac->mc_dev. Every successful connect therefore leaks one device reference when the MAC is subsequently disconnected. This is a memory leak class defect affecting kernel struct device refcounting.
Root Cause
The root cause is asymmetric reference counting between the connect and disconnect code paths in the dpaa2-switch driver. The connect path acquires a reference through device_find_child() but the disconnect path omits the corresponding put_device() call before freeing the containing dpaa2_mac structure. The upstream fix adds the missing reference drop prior to deallocation.
Attack Vector
The defect is triggered by legitimate switch port management operations that repeatedly connect and disconnect MAC endpoints. A local actor with the ability to manipulate DPAA2 switch port state can accelerate reference accumulation. Because the leak involves kernel struct device objects rather than attacker-controlled memory, the practical impact is resource exhaustion and blocked device teardown rather than direct code execution.
No public exploit code has been described for this issue. See the Linux Kernel Commit for the reference implementation of the fix.
Detection Methods for CVE-2026-68333
Indicators of Compromise
- Kernel messages referencing dpaa2-switch port connect and disconnect activity without corresponding device release logging
- Growing struct device reference counts on DPAA2 MAC endpoint objects observed via sysfs or kernel debugging interfaces
- Devices that fail to fully unregister after switch port disconnect operations
Detection Strategies
- Audit the running kernel version and compare against the fixed commits listed in the stable tree references
- Instrument kmemleak or KASAN on test systems running DPAA2 workloads to observe unfreed device references
- Track dpaa2-switch connect and disconnect events in host telemetry and correlate with device lifecycle counters
Monitoring Recommendations
- Ingest kernel logs and DPAA2 driver messages into a centralized log platform to surface repeated connect and disconnect sequences on production hardware
- Monitor overall kernel memory usage trends on NXP DPAA2 platforms and alert on unbounded growth of device-related slab caches
- Track kernel package versions across the fleet and flag hosts that lag behind vendor patch releases
How to Mitigate CVE-2026-68333
Immediate Actions Required
- Identify systems running NXP DPAA2 hardware with the dpaa2-switch driver loaded
- Apply vendor-provided kernel updates that include the upstream fix commits
- Restrict administrative access to interfaces that trigger switch port connect and disconnect operations while patching is in progress
Patch Information
The fix drops the endpoint device reference before freeing the dpaa2_mac object. Patched commits are available in the mainline and stable trees, including 1f4ca61b7a93, 26ac2d360234, 4c1eabbef7a1, 680eecc850d3, and c27694ff6748. Rebuild or upgrade the kernel package to a version that incorporates these commits.
Workarounds
- Avoid unnecessary connect and disconnect cycles on dpaa2-switch ports on unpatched systems
- Schedule periodic reboots on long-running DPAA2 hosts until the fixed kernel is deployed
- Where feasible, disable or unload the dpaa2-switch driver on systems that do not require switch port functionality
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
