CVE-2026-23257

Vulnerability

In the Linux kernel's liquidio driver, the setup_nic_devices() function contains an off-by-one error in its cleanup loop. On initialization failure, the loop while(i--) skips the failing index i, leading to a memory leak for that index. This affects versions prior to the fix introduced in stable kernel commits [1].

Exploitation

An attacker requires the ability to trigger a failure during setup_nic_devices() execution, which may occur during device initialization or configuration. The vulnerability is only reachable when an error occurs in the initialization loop, making exploitation dependent on inducing such a failure. No authentication is necessary if the attacker can control device parameters or cause resource exhaustion.

Impact

A local attacker could cause a memory leak, potentially leading to system instability or denial of service due to memory exhaustion. The leak is limited to the failing index and does not provide code execution or privilege escalation.

Mitigation

The fix is included in Linux kernel stable updates as of 2026 [1]. Users should update to the latest kernel version containing the patch. No workaround is available for unpatched systems.