CVE-2026-72023: octeontx2-pf: fix SQB pointer leak on init failure
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix SQB pointer leak on init failure
otx2inithwresources() initializes SQ aura and pool resources before several later setup steps. On failure, errfreesqptrs only frees SQB pages, leaving the per-SQ sqbptrs arrays behind.
Use otx2freesqres() for the SQ unwind path and let it free sqbptrs even when sq->sqe has not been allocated yet.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.
An x8664 allyesconfig build showed no new warnings. As we do not have an OcteonTX2 PF device and the corresponding AF mailbox setup to test with, no runtime testing was able to be performed.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Linux kernel (octeontx2-pf)to a version that resolves this vulnerability.Fixed in v7.1.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in v6.13-rc1 - Upgrade
Upgrade
Linux kernel (octeontx2-pf)to a version that resolves this vulnerability.Patch octeontx2-pf: fix SQB pointer leak on init failure - Configuration
Change the SQ unwind path handling on init failure so that err_free_sq_ptrs uses otx2_free_sq_res() to free sqb_ptrs (SQB pointer leak fix).
octeontx2-pf SQ unwind path (err_free_sq_ptrs behavior) = Use otx2_free_sq_res() so it frees sqb_ptrs
Event History
Frequently Asked Questions
What is the severity of CVE-2026-72023?
The severity of CVE-2026-72023 is rated high with a score of 12.
What systems are affected by CVE-2026-72023?
CVE-2026-72023 affects the Linux kernel specifically related to octeontx2-pf hardware.
How do I fix CVE-2026-72023?
To fix CVE-2026-72023, users should update to the latest version of the Linux kernel that contains the patch for this vulnerability.
What does CVE-2026-72023 exploit?
CVE-2026-72023 exploits a pointer leak during the initialization failure of SQ aura and pool resources.
Is CVE-2026-72023 exploitable remotely?
CVE-2026-72023 is not considered remotely exploitable as it requires local privileges to leverage the vulnerability.