Linux Kernel CVE-2026-53261

The Linux kernel devlink subsystem (cpe:2.3:o:linux:linux_kernel) provides a unified interface for managing networking devices and their sub-functions (SFs). Nested devlink relations are established between a child SF devlink instance and its parent before the child completes registration via devl_register(). Under CWE-401 (Missing Release of Memory After Effective Lifetime), if probe fails after the relation is created but before devl_register() is reached, devlink_free() is called directly. Because devl_unregister() - which invokes devlink_rel_put() to release devlink->rel - is never called on an unregistered instance, the relation pointer is permanently leaked. The fix adds relation cleanup to devlink_free() itself, guarding against this race between SF probe failure and the registration lifecycle, without affecting the normal registered path where devl_unregister() already clears devlink->rel before devlink_free() runs.