In the Linux kernel, the following vulnerability has been resolved: llc: fix SAP refcount leak in llcuiautobind() llcuiautobind() opens a SAP after choosing a dynamic LSAP. llcsapopen() returns a reference owned by the caller, and llcsapaddsocket() takes a second reference for the socket's membership in the SAP hash tables. llcuibind() drops the caller's reference after adding the socket, but llcuiautobind() keeps it. When the socket is closed, llcsapremovesocket() releases only the socket reference, leaving the SAP on llcsaplist with skcount == 0. This is user-visible because repeated autobind and close cycles can consume all dynamic SAP values and make later autobinds fail with -EUSERS. Drop the caller's reference after a successful autobind, matching llcui_bind()'s ownership model.