CVE-2026-23257
Received Received - Intake
Off-by-One Error in Linux net/liquidio Causes Memory Leak

Publication date: 2026-03-18

Last updated on: 2026-03-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-03-18
Generated
2026-05-07
AI Q&A
2026-03-18
EPSS Evaluated
2026-05-05
NVD
CVE-2026-23257
EUVD
EUVD-2026-12888
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
liquidio linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability is an off-by-one error in the Linux kernel's liquidio network driver, specifically in the setup_nic_devices() function. When initializing network interface cards (NICs), if an error occurs, the cleanup loop skips the failing device index, which causes a memory leak. The fix involves changing the cleanup loop to correctly iterate from the current index down to zero, ensuring all allocated resources are properly freed.


How can this vulnerability impact me? :

The vulnerability can lead to a memory leak in the Linux kernel when the liquidio driver fails to properly clean up after a device initialization error. Over time, this memory leak could degrade system performance or stability, potentially causing resource exhaustion or crashes in systems using the affected driver.


How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:

I don't know


How can this vulnerability be detected on my network or system? Can you suggest some commands?

I don't know


What immediate steps should I take to mitigate this vulnerability?

I don't know


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart