Medium 5.5Published Mar 18, 2026

CVE-2026-23256net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup

Updated under an hour ago (Oct 27, 2026, 2:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in VF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Compile tested only. Issue found using code review.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 before bd680e56e316be92c01568be98d85d7a6c9bd92c; 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 builds before 01fbca1e93ec3f39f76c31a8f9afa32ce00da48a; 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 builds before 71a56b89203ec7e5670d94a61a9b4ae617eca804; 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 builds before 3bf519e39b51cb08a93c0599870b35a23db1031e; 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 builds before 52b19b3a22306fe452ec9e8ff96063f4bfb77b99; from 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 before 4640fa5ad5e1a0dbd1c2d22323b7d70a8107dcfd; 846b46873eeb3baf40f7e6d8fe8f98aec95e7727 builds before 6cbba46934aefdfb5d171e0a95aec06c24f7ca30	CNA record
linux linux_kernel linux:linux_kernel	from 4.10 before 5.10.250; from 5.11 before 5.15.200; from 5.16 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/bd680e56e316be92c01568be98d85d7a6c9bd92c	patch
https://git.kernel.org/stable/c/01fbca1e93ec3f39f76c31a8f9afa32ce00da48a	patch
https://git.kernel.org/stable/c/71a56b89203ec7e5670d94a61a9b4ae617eca804	patch
https://git.kernel.org/stable/c/3bf519e39b51cb08a93c0599870b35a23db1031e	patch
https://git.kernel.org/stable/c/52b19b3a22306fe452ec9e8ff96063f4bfb77b99	patch
https://git.kernel.org/stable/c/4640fa5ad5e1a0dbd1c2d22323b7d70a8107dcfd	patch
https://git.kernel.org/stable/c/6cbba46934aefdfb5d171e0a95aec06c24f7ca30	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.