The liquidio network device driver in the Linux kernel has a flaw where if obtaining the PF number fails, the driver returns without unmapping either BAR or any associated Base Address Register. This results in a persistent memory‑mapped I/O region that the kernel never releases, leading to long‑term exhaustion of MMIO resources, degraded performance, or driver instability. The weakness is an improper release of a resource (CWE‑772).

Any Linux kernel version that includes the liquidio driver without the commit that unmaps both BARs on error is affected. The bug impacts the core kernel component and therefore applies to all distributions that ship a vulnerable kernel until they upgrade to a release that incorporates the fix.

The CVSS score of 5.5 indicates moderate severity. The EPSS score of less than 1% suggests a very low probability of exploitation. It is not listed in the CISA KEV catalog. The likely attack surface is local or privileged; an attacker with the ability to trigger driver initialization or swap devices could force the error path and create a resource leak. While this does not grant arbitrary code execution, repeated failures could cause memory pressure or even a denial‑of‑service condition, rendering the overall risk moderate.