CVE-2026-23256
Off-by-One Error in Linux liquidio VF Causes Memory Leak
Publication date: 2026-03-18
Last updated on: 2026-03-18
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| liquidio | linux_kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
What immediate steps should I take to mitigate this vulnerability?
I don't know
Can you explain this vulnerability to me?
This vulnerability is an off-by-one error in the Linux kernel's liquidio driver, specifically in the function setup_nic_devices().
During the initialization loop, if a failure occurs, the code jumps to a cleanup label. However, the cleanup loop incorrectly skips the failing index, which causes a memory leak.
The fix involves changing the cleanup loop to iterate correctly from the current index down to zero, ensuring all allocated resources are properly freed.
How can this vulnerability impact me? :
This vulnerability can lead to a memory leak in the Linux kernel's liquidio driver during network device initialization failures.
Memory leaks can degrade system performance over time and potentially lead to resource exhaustion, which might cause system instability or crashes.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
I don't know
How can this vulnerability be detected on my network or system? Can you suggest some commands?
I don't know