CVE-2026-72038

Received Received - Intake

LiquidIO BAR Resource Leak in Linux Kernel

Publication date: 2026-08-15

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xx_get_pf_num() fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-15

Last Modified

2026-08-17

Generated

2026-09-04

AI Q&A

2026-08-15

EPSS Evaluated

2026-09-03

NVD

CVE-2026-72038

EUVD

EUVD-2026-58996

Affected Vendors & Products

Vendor	Product	Version / Range
liquidio	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's net: liquidio driver. It involves a resource leak where BAR (Base Address Register) memory mappings are not properly released if a function called cn23xx_get_pf_num() fails. Normally, both BARs should be unmapped before exiting, but the error path skips this step, causing a leak.

Detection Guidance

This vulnerability is specific to the Linux kernel's liquidio driver and requires code review or kernel debugging to detect. No direct commands can identify this issue as it involves a resource leak during error handling in the driver.

Impact Analysis

The impact is limited to systems using the liquidio network driver in the Linux kernel. A resource leak could lead to memory exhaustion over time, potentially causing system instability or crashes. However, exploitation requires the driver to fail during PF number retrieval.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a resource leak in the Linux kernel's net: liquidio driver, which could lead to system instability or denial of service but does not involve data exposure or privacy violations.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. Monitor vendor advisories for kernel updates addressing the liquidio driver resource leak.

Hi! I’m here to help you understand CVE-2026-72038. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70