In the Linux kernel, the following vulnerability has been resolved: firmware_loader: fix device reference leak in firmware_upload_register() firmware_upload_register() -> fw_create_instance() -> device_initialize() After fw_cre…

Overview

In the Linux kernel, the following vulnerability has been resolved:

firmware_loader: fix device reference leak in firmware_upload_register()

firmware_upload_register() -> fw_create_instance() -> device_initialize()

After fw_create_instance() succeeds, the lifetime of the embedded struct device is expected to be managed through the device core reference counting, since fw_create_instance() has already called device_initialize().

In firmware_upload_register(), if alloc_lookup_fw_priv() fails after fw_create_instance() succeeds, the code reaches free_fw_sysfs and frees fw_sysfs directly instead of releasing the device reference with put_device(). This may leave the reference count of the embedded struct device unbalanced, resulting in a refcount leak.

The issue was identified by a static analysis tool I developed and confirmed by manual review. Fix this by using put_device(fw_dev) in the failure path and letting fw_dev_release() handle the final cleanup, instead of freeing the instance directly from the error path.

Affected

• linux_kernel >= 5.19, < 6.1.178
• linux_kernel >= 6.2, < 6.6.145
• linux_kernel >= 6.7, < 6.12.96
• linux_kernel >= 6.13, < 6.18.39
• linux_kernel >= 6.19, < 7.1.4

Remediation

Upgrade past the affected range:

• linux_kernel 7.1.4

Vendor advisories

• Red Hat VEX · Low · affected: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 9 · updated 2026-09-08 · vex