In the Linux kernel, the following vulnerability has been resolved: devlink: fix devlink_rel reference leak when notify work is pending… (CVE-2026-98953)

The vulnerability in the Linux kernel's devlink subsystem involves a reference leak in devlink_rel objects when notify work is pending. The function devlink_rel_nested_in_notify_work_schedule() takes a reference on the devlink_rel and queues delayed work without checking if the work was already pending. If the work is already queued, it runs only once and drops one reference, causing an extra reference to leak. This leak is triggered by registering and unregistering nested devlink instances multiple times while holding the parent devlink lock. Additionally, the reschedule path in devlink_rel_nested_in_notify_work() suffers from the same reference leak issue. The fix involves dropping the extra reference when the work is already pending, ensuring proper reference management.

The impact is a resource leak (memory leak) of devlink_rel objects in the Linux kernel, which could lead to increased memory consumption and potential stability issues over time. There is no indication of direct code execution or privilege escalation from this vulnerability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to properly drop the extra reference when notify work is already pending, preventing the reference leak. Users should update to the fixed kernel version once available. Since this is a kernel-level issue, applying the official kernel patch or upgrading to a patched kernel release is the recommended remediation.