CVE-2026-72023

Received Received - Intake

Memory Leak in OcteonTX2 PF Driver

Publication date: 2026-08-15

Last updated on: 2026-08-23

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: octeontx2-pf: fix SQB pointer leak on init failure otx2_init_hw_resources() initializes SQ aura and pool resources before several later setup steps. On failure, err_free_sq_ptrs only frees SQB pages, leaving the per-SQ sqb_ptrs arrays behind. Use otx2_free_sq_res() for the SQ unwind path and let it free sqb_ptrs even when sq->sqe has not been allocated yet. The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1. An x86_64 allyesconfig build showed no new warnings. As we do not have an OcteonTX2 PF device and the corresponding AF mailbox setup to test with, no runtime testing was able to be performed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-23

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72023

EUVD

EUVD-2026-58981

Affected Vendors & Products

Vendor	Product	Version / Range
linux	kernel	7.1.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a memory leak in the octeontx2-pf driver. When initializing hardware resources fails, the cleanup process does not properly free all allocated memory, specifically leaving behind per-SQ sqb_ptrs arrays. This occurs because the error handling path only frees SQB pages but not the sqb_ptrs arrays.

Detection Guidance

This vulnerability is specific to the Linux kernel's octeontx2-pf driver and involves a memory leak during initialization failure. Detection requires checking for memory leaks in the octeontx2 driver or kernel logs during driver initialization. No public tools or commands are provided for detection as the bug was found using an experimental tool not yet available.

Impact Analysis

The impact includes potential memory leaks which could lead to resource exhaustion over time. This may cause system instability, reduced performance, or crashes if the leaked memory accumulates significantly. Systems using the octeontx2-pf driver are primarily affected.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level memory management issue in the Linux kernel without clear implications for data protection or privacy.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Monitor kernel updates from your distribution and upgrade to a patched version. If using a vulnerable kernel version, avoid loading the octeontx2-pf driver or restrict its use to trusted environments until patched.

Hi! I’m here to help you understand CVE-2026-72023. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70