Linux Kernel CVE-2026-64376

The Linux kernel firmware_loader subsystem provides a mechanism for drivers to register firmware upload interfaces via sysfs. The function firmware_upload_register() orchestrates instance creation by first calling fw_create_instance(), which internally calls device_initialize() on an embedded struct device, transferring lifecycle management to the device reference-counting framework (kobject/kref). The bug manifests in the error-handling path: if alloc_lookup_fw_priv() subsequently fails, the code jumps to 'free_fw_sysfs' and frees the fw_sysfs structure directly via kfree() rather than via put_device(), which would invoke fw_dev_release() for proper cleanup. This violates the device core contract - once device_initialize() has been called, all cleanup must go through put_device(). The root cause is a resource management defect (conceptually CWE-401/CWE-772: missing release of resource) in a low-frequency error path. CPE cpe:2.3:a:linux:linux identifies the mainline and LTS kernel trees as affected, anchored to the introducing commit 97730bbb242c.