{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23258", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.990Z", "datePublished": "2026-03-18T17:41:05.080Z", "dateUpdated": "2026-05-11T22:03:22.860Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-11T22:03:22.860Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: liquidio: Initialize netdev pointer before queue setup\n\nIn setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq().\nHowever, the pointer to this structure is stored in oct->props[i].netdev\nonly after the calls to netif_set_real_num_rx_queues() and\nnetif_set_real_num_tx_queues().\n\nIf either of these functions fails, setup_nic_devices() returns an error\nwithout freeing the allocated netdev. Since oct->props[i].netdev is still\nNULL at this point, the cleanup function liquidio_destroy_nic_device()\nwill fail to find and free the netdev, resulting in a memory leak.\n\nFix this by initializing oct->props[i].netdev before calling the queue\nsetup functions. This ensures that the netdev is properly accessible for\ncleanup in case of errors.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cavium/liquidio/lio_main.c"], "versions": [{"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "be109646cdaecab262f6276303b1763468c94378", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "c81a8515fb8c8fb5d0dbc21f48337494bf1d60df", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "c0ed6c77ec34050971fd0df2a94dfdea66d09331", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "1d4590fde856cb94bd9a46e795c29d8288c238fc", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "d028147ae06407cb355245db1774793600670169", "status": "affected", "versionType": "git"}, {"version": "c33c997346c34ea7b89aec99524ad9632a2f1e0c", "lessThan": "926ede0c85e1e57c97d64d9612455267d597bb2c", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/net/ethernet/cavium/liquidio/lio_main.c"], "versions": [{"version": "4.18", "status": "affected"}, {"version": "0", "lessThan": "4.18", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.250", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.200", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.163", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.124", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.70", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.10.250"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "5.15.200"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.1.163"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.6.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.12.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.18", "versionEndExcluding": "6.19"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/be109646cdaecab262f6276303b1763468c94378"}, {"url": "https://git.kernel.org/stable/c/c81a8515fb8c8fb5d0dbc21f48337494bf1d60df"}, {"url": "https://git.kernel.org/stable/c/a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4"}, {"url": "https://git.kernel.org/stable/c/c0ed6c77ec34050971fd0df2a94dfdea66d09331"}, {"url": "https://git.kernel.org/stable/c/1d4590fde856cb94bd9a46e795c29d8288c238fc"}, {"url": "https://git.kernel.org/stable/c/d028147ae06407cb355245db1774793600670169"}, {"url": "https://git.kernel.org/stable/c/926ede0c85e1e57c97d64d9612455267d597bb2c"}], "title": "net: liquidio: Initialize netdev pointer before queue setup", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: liquidio: Initialize netdev pointer before queue setup\n\nIn setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq().\nHowever, the pointer to this structure is stored in oct->props[i].netdev\nonly after the calls to netif_set_real_num_rx_queues() and\nnetif_set_real_num_tx_queues().\n\nIf either of these functions fails, setup_nic_devices() returns an error\nwithout freeing the allocated netdev. Since oct->props[i].netdev is still\nNULL at this point, the cleanup function liquidio_destroy_nic_device()\nwill fail to find and free the netdev, resulting in a memory leak.\n\nFix this by initializing oct->props[i].netdev before calling the queue\nsetup functions. This ensures that the netdev is properly accessible for\ncleanup in case of errors.\n\nCompile tested only. Issue found using a prototype static analysis tool\nand code review."}], "id": "CVE-2026-23258", "lastModified": "2026-03-19T13:25:00.570", "metrics": {}, "published": "2026-03-18T18:16:24.167", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/1d4590fde856cb94bd9a46e795c29d8288c238fc"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/926ede0c85e1e57c97d64d9612455267d597bb2c"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/be109646cdaecab262f6276303b1763468c94378"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c0ed6c77ec34050971fd0df2a94dfdea66d09331"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c81a8515fb8c8fb5d0dbc21f48337494bf1d60df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/d028147ae06407cb355245db1774793600670169"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: net: liquidio: Initialize netdev pointer before queue setup", "id": "2448713", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448713"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23258", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23258\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23258\nhttps://lore.kernel.org/linux-cve-announce/2026031818-CVE-2026-23258-d181@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,be109646cdaecab262f6276303b1763468c94378)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,c81a8515fb8c8fb5d0dbc21f48337494bf1d60df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,c0ed6c77ec34050971fd0df2a94dfdea66d09331)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,1d4590fde856cb94bd9a46e795c29d8288c238fc)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,d028147ae06407cb355245db1774793600670169)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c33c997346c34ea7b89aec99524ad9632a2f1e0c,926ede0c85e1e57c97d64d9612455267d597bb2c)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "4.18"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,4.18)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.10.250,5.11.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.200,5.16.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.163,6.2.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.124,6.7.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.70,6.13.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.10,6.19.0]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-03-27T21:56:12.314488+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel patch that initializes the netdev pointer before queue setup.", "Verify that your running kernel contains the commit that addresses the issue; if not, plan a kernel upgrade.", "If an update is not immediately available, monitor kernel memory usage and avoid repeated liquidio NIC configuration until patched."], "summary": {"action": "Apply Patch", "impact": "Denial of Service"}, "threat_synthesis": {"affected_systems": "The flaw resides in the liquidio networking driver of the Linux kernel. Any kernel release that incorporates this driver and contains the affected code path is potentially vulnerable. No specific version range is provided, so administrators should verify whether their kernel contains the commit that addresses the issue.", "description_and_impact": "The Linux kernel liquidio driver allocates a network device but defers storing its pointer until queue configuration calls. If queue setup fails, the allocated structure is not freed because cleanup expects the pointer to be set. This results in a kernel memory leak that can accumulate over time and eventually exhaust kernel memory, leading to system instability or a denial of service.", "risk_and_exploitability": "The vulnerability carries a moderate severity rating. Exploitation would likely require local or elevated privileges to trigger the faulty device setup, such as manipulating NIC configuration. The attack surface is limited to the kernel; there is no arbitrary code execution path. The low probability of public exploitation and absence from known exploited catalogs suggest a lower likelihood of immediate risk, but repeated failures can lead to resource exhaustion."}}}}, "created": "2026-03-19T08:56:00.923865+00:00", "updated": "2026-03-29T20:29:01.461868+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401"]}