{"apiVersion":"1.0","identifier":"CVE-2026-72022","description":"In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llc_ui_autobind() llc_ui_autobind() opens a SAP after choosing a dynamic LSAP. llc_sap_open() returns a reference owned by the caller, and llc_sap_add_socket() takes a second reference for the socket-s membership in the SAP hash tables. llc_ui_bind() drops the caller-s reference after adding the socket, but llc_ui_autobind() keeps it. When the socket is closed, llc_sap_remove_socket() releases only the socket reference, leaving the SAP on llc_sap_list with sk_count == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller-s reference after a successful autobind, matching llc_ui_bind()-s ownership model.","publishedAt":"2026-08-15T06:21:01","lastModifiedAt":"2026-08-17T06:17:59","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-72022","cvssScore":null,"cvssVector":"Pending","epssProbability":0.00211,"riskScore":0,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-72022","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-72022","en":"https://www.redsauce.net/en/cves/CVE-2026-72022","fr":"https://www.redsauce.net/fr/cves/CVE-2026-72022","pt":"https://www.redsauce.net/pt/cves/CVE-2026-72022","de":"https://www.redsauce.net/de/cves/CVE-2026-72022","sk":"https://www.redsauce.net/sk/cves/CVE-2026-72022","el":"https://www.redsauce.net/el/cves/CVE-2026-72022"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-72022"}}