CVE-2026-23258
Analyzed Analyzed - Analysis Complete
Memory Leak in Linux Kernel liquidio Driver Due to Improper netdev Initialization

Publication date: 2026-03-18

Last updated on: 2026-05-29

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak. Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors. Compile tested only. Issue found using a prototype static analysis tool and code review.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-03-18
Last Modified
2026-05-29
Generated
2026-06-16
AI Q&A
2026-03-18
EPSS Evaluated
2026-06-15
NVD
CVE-2026-23258
EUVD
EUVD-2026-12890
Affected Vendors & Products
Showing 14 associated CPEs
Vendor Product Version / Range
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 5.16 (inc) to 6.1.163 (exc)
linux linux_kernel From 6.7 (inc) to 6.12.70 (exc)
linux linux_kernel From 6.2 (inc) to 6.6.124 (exc)
linux linux_kernel 6.19
linux linux_kernel From 6.13 (inc) to 6.18.10 (exc)
linux linux_kernel 6.19
linux linux_kernel 6.19
linux linux_kernel From 5.11 (inc) to 5.15.200 (exc)
linux linux_kernel From 4.18 (inc) to 5.10.250 (exc)
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-401 The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability exists in the Linux kernel's liquidio network driver. During the setup of network interface devices in the function setup_nic_devices(), a network device structure (netdev) is allocated but not properly initialized before setting up transmit and receive queues.

If the queue setup functions fail, the allocated netdev pointer remains NULL in the device properties, preventing the cleanup function from freeing the allocated memory. This results in a memory leak.

The fix involves initializing the netdev pointer before calling the queue setup functions to ensure proper cleanup in case of errors.

Impact Analysis

This vulnerability can lead to a memory leak in the Linux kernel's liquidio network driver. If the queue setup fails, allocated memory for network devices is not freed properly.

Over time, this memory leak could degrade system performance or stability, potentially causing resource exhaustion or crashes in systems using the affected driver.

Compliance Impact

I don't know

Detection Guidance

I don't know

Mitigation Strategies

The vulnerability is caused by improper initialization of the netdev pointer before queue setup in the liquidio driver, leading to a potential memory leak.

To mitigate this vulnerability, update the Linux kernel to a version where this issue is fixed, ensuring that the netdev pointer is initialized before calling netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues().

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-23258. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart