Executive brief
The OcteonTX2 network interface driver in the Linux kernel fails to properly clean up allocated memory when hardware initialization encounters an error. Specifically, send queue buffer pointer arrays are left behind during error recovery, causing a kernel memory leak that could degrade system stability over time if initialization errors occur repeatedly.
Technical details
This is a resource leak vulnerability in the otx2_init_hw_resources() function within the OcteonTX2 Marvell network driver. During hardware resource initialization, SQ (send queue) aura and pool resources are allocated. When subsequent initialization steps fail, the error path calls err_free_sq_ptrs which invokes otx2_sq_free_sqbs(), freeing only SQB (send queue buffer) pages but leaving the per-SQ sqb_ptrs arrays allocated in kernel memory. The fix changes the error path to call otx2_free_sq_res() instead, which properly frees the sqb_ptrs arrays regardless of whether sq->sqe has been initialized. The vulnerability affects systems using Marvell OcteonTX2 network adapters and is triggered only during initialization failure scenarios, making it a low-severity information/memory management issue rather than a direct security risk.
Affected products
- Linux Linux kernel v6.13-rc1 and later, confirmed in v7.1.1
Timeline
- 2026-08-15: disclosed: CVE-2026-72023 published
- 2026-07-28: patched: Patch committed upstream (62e7df6d042aeebd5efb581074e28865c04477be)
- 2026-06-30: other: Patch initially applied to stable kernel