In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup

In setup_nic_devices(), the initialization loop jumps to the label
setup_nic_dev_free on failure. The current cleanup loop while(i--)
skip the failing index i, causing a memory leak.

Fix this by changing the loop to iterate from the current index i
down to 0.

Also, decrement i in the devlink_alloc failure path to point to the
last successfully allocated index.

Compile tested only. Issue found using code review.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< af38d9a5cb49fe9d0d282b44f17fdc1f3270d99d
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< d86c58eb005eb99da402452f3db7a6e0eae32815
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< f1216b80c9040a904d2ad7c8cd24ca0ff1f36932
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< a0d2389c8cdc1f05de5eb8663bffe9ed05dca769
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< f86bd16280a0f88b538394e0565c56ce4756da99
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< 293eaad0d6d6b2a37a458c7deb7be345349cd963
f21fb3ed364bb83533c5efe19354e337ea9ecda9 affected
< 8558aef4e8a1a83049ab906d21d391093cfa7e7f
Linux Linux affected
Version Status Constraints
4.2 affected
—
0 unaffected
< 4.2
5.10.250 unaffected
≤ 5.10.*
5.15.200 unaffected
≤ 5.15.*
6.1.163 unaffected
≤ 6.1.*
6.6.124 unaffected
≤ 6.6.*
6.12.70 unaffected
≤ 6.12.*
6.18.10 unaffected
≤ 6.18.*
6.19 unaffected
≤ *

No data.

No data.

No data.

Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/293eaad0d6d6b2a37a458c7deb7be345349cd963 cve-icon cve-icon
https://git.kernel.org/stable/c/8558aef4e8a1a83049ab906d21d391093cfa7e7f cve-icon cve-icon
https://git.kernel.org/stable/c/a0d2389c8cdc1f05de5eb8663bffe9ed05dca769 cve-icon cve-icon
https://git.kernel.org/stable/c/af38d9a5cb49fe9d0d282b44f17fdc1f3270d99d cve-icon cve-icon
https://git.kernel.org/stable/c/d86c58eb005eb99da402452f3db7a6e0eae32815 cve-icon cve-icon
https://git.kernel.org/stable/c/f1216b80c9040a904d2ad7c8cd24ca0ff1f36932 cve-icon cve-icon
https://git.kernel.org/stable/c/f86bd16280a0f88b538394e0565c56ce4756da99 cve-icon cve-icon
https://lore.kernel.org/linux-cve-announce/2026031818-CVE-2026-23257-bd18@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-23257 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-23257 cve-icon
History

Thu, 19 Mar 2026 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Wed, 18 Mar 2026 18:00:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review.
Title net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-03-18T17:41:04.078Z

Reserved: 2026-01-13T15:37:45.990Z

Link: CVE-2026-23257

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-03-18T18:16:23.997

Modified: 2026-03-18T18:16:23.997

Link: CVE-2026-23257

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-03-18T00:00:00Z

Links: CVE-2026-23257 - Bugzilla

cve-icon OpenCVE Enrichment

No data.

Weaknesses

No weakness.