CVE-2026-43375

net: mctp: fix device leak on probe failure

published May 8, 2026

CVSS
—
EPSS
0%
Percentile
4.8
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

net: mctp: fix device leak on probe failure

Driver core holds a reference to the USB interface and its parent USB

device while the interface is bound to a driver and there is no need to

take additional references unless the structures are needed after

disconnect.

This driver takes a reference to the USB device during probe but does

not to release it on probe failures.

Drop the redundant device reference to fix the leak, reduce cargo

culting, make it easier to spot drivers where an extra reference is

needed, and reduce the risk of further memory leaks.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00160 · 4.8th percentile
Published
2026-05-08T14:21Z
EPSS history
Timeline
  • 08 MAY 14:21Z
    net: mctp: fix device leak on probe failure
    cvelistv5