Junglewise Threat Intelligence

CVE-2026-23256: Linux Kernel LiquidIO off-by-one error in setup_nic_devices

CVE-2026-23256 · Severity: medium · CVSS 5.5 · Published 2026-03-18

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability exists in the Linux kernel's LiquidIO network driver that can lead to memory leaks. This driver is used to support certain high-performance network interface cards. If the system fails to initialize these network devices, it may fail to properly release memory, potentially leading to system instability or a denial-of-service over time.

Technical details

An off-by-one error exists in the 'setup_nic_devices()' function within the LiquidIO VF driver ('drivers/net/ethernet/cavium/liquidio/lio_vf_main.c'). When initialization fails, the code jumps to a cleanup label where a 'while(i--)' loop is used to free resources. Because the post-decrement operator is used, the loop skips the resource at the current index 'i' where the failure occurred, resulting in a memory leak. An attacker with local access could potentially exploit this to exhaust system memory by repeatedly triggering failed device setups. The fix replaces the loop with a 'do { ... } while (i--)' construct to ensure the failing index is included in the cleanup.

Affected products

  • Linux Linux Kernel 4.10 to 5.10.250, 5.11 to 5.15.200, 5.16 to 6.1.163, 6.2 to 6.6.124, 6.7 to 6.12.70, 6.13 to 6.18.10

Timeline

  • 2026-03-18: disclosed
  • 2026-02-11: patched: Patch committed to stable tree.
  • 2026-03-18: advisory

References