An off‑by‑one error in the liquidio driver’s VF setup_nic_devices() cleanup loop causes a memory leak when device initialization fails. Because the loop incorrectly skips the failing index, the driver does not release the allocated resources, potentially allowing an attacker or a faulty request to accumulate unreleased memory over time and degrade system stability or availability.

The vulnerability exists in the Linux kernel, affecting versions that include the liquidio networking driver. Specific version details are not listed in the advisory, so any kernel build that contains the liquidio driver at the time of the defect is potentially impacted.

The CVSS score of 5.5 indicates a moderate impact, and the EPSS score is below 1%, suggesting a very low probability of exploitation in the wild. The vulnerability is not currently listed in CISA’s KEV catalog. The nature of the flaw is a memory leak, which requires a failure during VF device setup to be triggered. While this does not directly lead to code execution, repeated exploitation could exhaust kernel memory or cause service interruptions. No publicly available exploitation vector is documented, so the risk is primarily theoretical under normal operating conditions.