Medium 5.5Published Mar 18, 2026

CVE-2026-23257net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup

Updated under an hour ago (Oct 27, 2026, 7:23 PM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Fix off-by-one error in PF setup_nic_devices() cleanup In setup_nic_devices(), the initialization loop jumps to the label setup_nic_dev_free on failure. The current cleanup loop while(i--) skip the failing index i, causing a memory leak. Fix this by changing the loop to iterate from the current index i down to 0. Also, decrement i in the devlink_alloc failure path to point to the last successfully allocated index. Compile tested only. Issue found using code review.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: May 11, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before af38d9a5cb49fe9d0d282b44f17fdc1f3270d99d; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before d86c58eb005eb99da402452f3db7a6e0eae32815; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before f1216b80c9040a904d2ad7c8cd24ca0ff1f36932; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before a0d2389c8cdc1f05de5eb8663bffe9ed05dca769; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before f86bd16280a0f88b538394e0565c56ce4756da99; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before 293eaad0d6d6b2a37a458c7deb7be345349cd963; from f21fb3ed364bb83533c5efe19354e337ea9ecda9 before 8558aef4e8a1a83049ab906d21d391093cfa7e7f	CNA record
linux linux_kernel linux:linux_kernel	from 4.2 before 5.10.250; from 5.11 before 5.15.200; from 5.16 before 6.1.163; from 6.2 before 6.6.124; from 6.7 before 6.12.70; from 6.13 before 6.18.10; 6.19; 6.19; and 6 more ranges	NVD

References

References

https://git.kernel.org/stable/c/af38d9a5cb49fe9d0d282b44f17fdc1f3270d99d	patch
https://git.kernel.org/stable/c/d86c58eb005eb99da402452f3db7a6e0eae32815	patch
https://git.kernel.org/stable/c/f1216b80c9040a904d2ad7c8cd24ca0ff1f36932	patch
https://git.kernel.org/stable/c/a0d2389c8cdc1f05de5eb8663bffe9ed05dca769	patch
https://git.kernel.org/stable/c/f86bd16280a0f88b538394e0565c56ce4756da99	patch
https://git.kernel.org/stable/c/293eaad0d6d6b2a37a458c7deb7be345349cd963	patch
https://git.kernel.org/stable/c/8558aef4e8a1a83049ab906d21d391093cfa7e7f	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.