CVE-2026-23257

net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup

State: Published
Severity: Not scored
Published: Mar 18, 2026
Updated: May 11, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup

In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak.

Fix this by changing the loop to iterate from the current index i down to 0.

Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index.

Compile tested only. Issue found using code review.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before af38d9a5cb49fe9d0d282b44f17fdc1f3270d99dAffected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before d86c58eb005eb99da402452f3db7a6e0eae32815Affected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before f1216b80c9040a904d2ad7c8cd24ca0ff1f36932Affected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before a0d2389c8cdc1f05de5eb8663bffe9ed05dca769Affected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before f86bd16280a0f88b538394e0565c56ce4756da99Affected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before 293eaad0d6d6b2a37a458c7deb7be345349cd963Affected f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before 8558aef4e8a1a83049ab906d21d391093cfa7e7fAffected
LinuxLinux	4.2Affected before 4.2Not affected 5.10.250 through 5.10.Not affected 5.15.200 through 5.15.Not affected 6.1.163 through 6.1.Not affected 6.6.124 through 6.6.Not affected 6.12.70 through 6.12.Not affected 6.18.10 through 6.18.Not affected 6.19 and laterNot affected

Product

Versions

LinuxLinux

f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before af38d9a5cb49fe9d0d282b44f17fdc1f3270d99dAffected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before d86c58eb005eb99da402452f3db7a6e0eae32815Affected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before f1216b80c9040a904d2ad7c8cd24ca0ff1f36932Affected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before a0d2389c8cdc1f05de5eb8663bffe9ed05dca769Affected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before f86bd16280a0f88b538394e0565c56ce4756da99Affected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before 293eaad0d6d6b2a37a458c7deb7be345349cd963Affected
f21fb3ed364bb83533c5efe19354e337ea9ecda9 to before 8558aef4e8a1a83049ab906d21d391093cfa7e7fAffected

LinuxLinux

4.2Affected
before 4.2Not affected
5.10.250 through 5.10.*Not affected
5.15.200 through 5.15.*Not affected
6.1.163 through 6.1.*Not affected
6.6.124 through 6.6.*Not affected
6.12.70 through 6.12.*Not affected
6.18.10 through 6.18.*Not affected
6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.