CVE-2026-64376

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: fix device reference leak in firmware_upload_register()

firmware_upload_register()

-> fw_create_instance()

-> device_initialize()

After fw_create_instance() succeeds, the lifetime of the embedded struct

device is expected to be managed through the device core reference

counting, since fw_create_instance() has already called

device_initialize().

In firmware_upload_register(), if alloc_lookup_fw_priv() fails after

fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees

fw_sysfs directly instead of releasing the device reference with

put_device(). This may leave the reference count of the embedded struct

device unbalanced, resulting in a refcount leak.

The issue was identified by a static analysis tool I developed and

confirmed by manual review. Fix this by using put_device(fw_dev) in the

failure path and letting fw_dev_release() handle the final cleanup,

instead of freeing the instance directly from the error path.