PT-2026-26118 · Linux · Linux

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-23258

NVD

In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: Initialize netdev pointer before queue setup

In setup nic devices(), the netdev is allocated using alloc etherdev mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif set real num rx queues() and netif set real num tx queues().

If either of these functions fails, setup nic devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio destroy nic device() will fail to find and free the netdev, resulting in a memory leak.

Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Related Identifiers

CVE-2026-23258

Affected Products

Linux

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-23258 · Security Note
• https://git.kernel.org/stable/c/be109646cdaecab262f6276303b1763468c94378 · Note
• https://git.kernel.org/stable/c/1d4590fde856cb94bd9a46e795c29d8288c238fc · Note
• https://git.kernel.org/stable/c/a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4 · Note
• https://git.kernel.org/stable/c/c0ed6c77ec34050971fd0df2a94dfdea66d09331 · Note
• https://git.kernel.org/stable/c/c81a8515fb8c8fb5d0dbc21f48337494bf1d60df · Note
• https://git.kernel.org/stable/c/d028147ae06407cb355245db1774793600670169 · Note
• https://git.kernel.org/stable/c/926ede0c85e1e57c97d64d9612455267d597bb2c · Note