CVE-2026-23258: net: liquidio: Initialize netdev pointer before queue setup
In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Initialize netdev pointer before queue setup
In setupnicdevices(), the netdev is allocated using allocetherdevmq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netifsetrealnumrxqueues() and netifsetrealnumtxqueues().
If either of these functions fails, setupnicdevices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidiodestroynicdevice() will fail to find and free the netdev, resulting in a memory leak.
Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors.
Compile tested only. Issue found using a prototype static analysis tool and code review.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23258?
CVE-2026-23258 has been classified with moderate severity due to potential risks in network device setups.
How do I fix CVE-2026-23258?
To fix CVE-2026-23258, update the Linux kernel to the latest version that includes the patch for this vulnerability.
What are the potential impacts of CVE-2026-23258?
The potential impacts of CVE-2026-23258 include system instability and network issues related to improperly initialized network devices.
Which systems are affected by CVE-2026-23258?
CVE-2026-23258 affects specific versions of the Linux kernel that utilize the liquidio driver for network interface cards.
How was CVE-2026-23258 discovered?
CVE-2026-23258 was discovered during code analysis of the Linux kernel, focusing on the initialization process for network devices.