net: ixp4xx_hss: fix duplicate HDLC netdev allocation
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from CNA.
Summary
In the Linux kernel, the following vulnerability has been resolved: net: ixp4xx_hss: fix duplicate HDLC netdev allocation ixp4xx_hss_probe() allocates two HDLC netdevs. The first one is stored in ndev, initialized, and registered with register_hdlc_device(). The second one is stored in port->netdev and later used by the remove path for unregister_hdlc_device() and free_netdev(). This means that the registered netdev is not the same object that is unregistered and freed on remove. It also leaks the first allocation if the second alloc_hdlcdev() call fails, and the first allocation is not checked before ndev is used. Older code allocated the HDLC netdev only once and stored the same object in both the local variable and port->netdev. The buggy conversion split this into two alloc_hdlcdev() calls. A later rename changed the local variable name to ndev, but the underlying mismatch remained. Fix this by allocating the HDLC netdev only once and assigning the same object to port->netdev.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
Remediation
- Fix · CNA Linux (Linux) Fixed in 5.15.217, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, 7.2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 5 products
- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
Timeline
- 2026-10-02 Threatist record created from CVE-2026-72058
- 2026-10-03 Alias added: GHSA-c9wj-7pm2-vx6f
References
Other 7
- https://git.kernel.org/stable/c/77d925b948ee594a79afe66f85bb94b67940140b
- https://git.kernel.org/stable/c/8f4c3c384092becbf4835a3f8ed8a3df1f544578
- https://git.kernel.org/stable/c/fd0b939ebd1eee29945a539c5ed65c35dddac8d6
- https://git.kernel.org/stable/c/ffba16e6f55948d94b7f16aa113d587c1c4c0643
- https://git.kernel.org/stable/c/3f85fcd520aa703824b1958f35169925ddae2558
- https://git.kernel.org/stable/c/91850f582783098415a334f8bd0a84c87ff15a8c
- https://git.kernel.org/stable/c/db818b0e8af7bac16860116a19c341a63d6677b4
More Linux vulnerabilities
- TI-2025-26358 tls: fix handling of zero-length records on the rx_list KEVCVSS 3.1CRITICAL 9.8
- TI-2026-38352 netfilter: bridge: make ebt_snat ARP rewrite writable KEVCVSS 3.1HIGH 8.8
- TI-2021-02452 Incorrect authorization in Ubuntu linux kernel KEVCVSS 3.1HIGH 8.8
- TI-2013-05264 The (1) get_user and (2) put_user API functions in the Linux kernel before 3.5.5 on the… KEVCVSS 3.1HIGH 8.8
- TI-2022-00125 Integer overflow in kernel KEVCVSS 3.1HIGH 8.4
- TI-2013-01864 The perf_swevent_init function in kernel/events/core.c in the Linux kernel before 3.8.9… KEVCVSS 3.1HIGH 8.4
Sources
- CVE-2026-72058 · CVE Program
- CVE-2026-72058 · NVD
- FIRST EPSS
- GHSA-c9wj-7pm2-vx6f · GitHub Advisory Database · CC BY 4.0
- CVE-2026-72058 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences