{"id":"CVE-2026-53261","title":"devlink: Release nested relation on devlink free","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: Release nested relation on devlink free\n\ndevlink relation state is normally released from devl_unregister(), which\ncalls devlink_rel_put(). This misses devlink…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < a9137286884703113b1c9e6403bd6d7d97b14754","Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 927f96861f939c0b517d13ed27bf4fabbfc1cfb3","Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 11324d52b0c63f4f202b35793c6507a575e9a689","Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 3522b21fd7e1863d0734537737bd59f1b90d0190","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:24:30.578515Z"},"published":"2026-06-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:16.439Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-53261","references":[{"url":"https://git.kernel.org/stable/c/a9137286884703113b1c9e6403bd6d7d97b14754"},{"url":"https://git.kernel.org/stable/c/927f96861f939c0b517d13ed27bf4fabbfc1cfb3"},{"url":"https://git.kernel.org/stable/c/11324d52b0c63f4f202b35793c6507a575e9a689"},{"url":"https://git.kernel.org/stable/c/3522b21fd7e1863d0734537737bd59f1b90d0190"}],"tags":["cve.org"],"epss":0.00114,"epssPercentile":0.01467,"ingestedAt":"2026-11-06T16:57:43.260Z","slug":"CVE-2026-53261","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ndevlink: Release nested relation on devlink free\n\ndevlink relation state is normally released from devl_unregister(), which\ncalls devlink_rel_put(). This misses devlink instances that get a nested\nrelation before registration and then fail probe before devl_register() is\nreached.\n\nThat flow can happen for SFs. The child devlink gets linked to its\nparent before registration, then a later probe error calls devlink_free()\ndirectly. Since the instance was never registered, devl_unregister() is not\ncalled and devlink->rel is leaked.\n\nRelease any pending relation from devlink_free() as well. The registered\npath is unchanged because devl_unregister() already clears devlink->rel\nbefore devlink_free() runs.\n\n## Affected\n\n- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < a9137286884703113b1c9e6403bd6d7d97b14754`\n- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 927f96861f939c0b517d13ed27bf4fabbfc1cfb3`\n- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 11324d52b0c63f4f202b35793c6507a575e9a689`\n- `Linux >= c137743bce02b18c1537d4681aa515f7b80bf0a8 < 3522b21fd7e1863d0734537737bd59f1b90d0190`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}