CVE-2026-23256: Linux Kernel Memory Leak Vulnerability

CVE-2026-23256 Overview

CVE-2026-23256 is a memory leak vulnerability in the Linux kernel's LiquidIO network driver, specifically affecting the Virtual Function (VF) setup_nic_devices() cleanup path. The vulnerability stems from an off-by-one error in the cleanup loop that causes the failing index to be skipped during resource deallocation, resulting in memory leaks.

The LiquidIO driver provides support for Cavium LiquidIO intelligent server adapters. When the setup_nic_devices() function encounters a failure during initialization, it attempts to clean up previously allocated resources. However, due to the incorrect loop condition using while(i--), the current failing index i is skipped, leaving allocated memory unreleased.

Critical Impact

Memory leak in Linux kernel LiquidIO driver cleanup path can lead to gradual memory exhaustion in systems using Cavium LiquidIO network adapters.

Affected Products

• Linux Kernel (multiple stable branches)
• Systems using Cavium LiquidIO intelligent server adapters
• Virtual Function (VF) configurations of LiquidIO network devices

Discovery Timeline

• 2026-03-18 - CVE CVE-2026-23256 published to NVD
• 2026-03-19 - Last updated in NVD database

Technical Details for CVE-2026-23256

Vulnerability Analysis

This vulnerability exists within the setup_nic_devices() function in the LiquidIO VF driver. The function initializes network devices in a loop, and upon encountering an error, it jumps to a cleanup label (setup_nic_dev_free) to release previously allocated resources.

The root cause is an off-by-one error in the cleanup loop implementation. When the initialization loop fails at index i, the cleanup code uses while(i--) to iterate through previously initialized devices. This post-decrement operation causes the loop to start cleanup from index i-1, completely skipping the resources that may have been partially allocated at the failing index i.

The issue was identified through code review and has been confirmed as compile-tested. In production environments with LiquidIO network adapters, this bug could lead to memory leaks during driver initialization failures, particularly in scenarios involving repeated load/unload cycles or dynamic VF configuration changes.

Root Cause

The vulnerability is caused by improper loop termination logic in the cleanup path. The while(i--) construct decrements the index before evaluating the loop condition and executing the cleanup code for that iteration. This means when an error occurs at index i, the loop starts cleaning up from i-1, leaving resources at index i leaked.

The fix modifies the cleanup loop to iterate from the current index i down to 0, ensuring all partially or fully allocated resources are properly freed, including those at the failing index.

Attack Vector

While this vulnerability is classified with an unknown attack vector, the practical impact is limited to local denial of service scenarios. An attacker with local access or the ability to trigger driver initialization failures could potentially exploit this memory leak to:

1. Cause gradual memory exhaustion on the system
2. Impact system stability through repeated triggering of the initialization failure path
3. Affect availability of systems relying on LiquidIO network connectivity

The vulnerability requires specific conditions to trigger, including the presence of LiquidIO hardware and the ability to cause initialization failures in the VF setup path.

Detection Methods for CVE-2026-23256

Indicators of Compromise

• Gradual increase in kernel memory usage on systems with LiquidIO adapters
• Memory allocation failures or OOM (Out-of-Memory) events following LiquidIO driver operations
• Kernel log entries indicating failed VF device initialization in the LiquidIO driver

Detection Strategies

• Monitor /proc/meminfo and /proc/slabinfo for unusual memory consumption patterns related to network device structures
• Implement kernel memory leak detection tools such as kmemleak to identify unreleased allocations
• Review dmesg output for LiquidIO driver initialization failures or error messages

Monitoring Recommendations

• Enable kernel memory debugging features (CONFIG_DEBUG_KMEMLEAK) in development and test environments
• Set up alerting for repeated LiquidIO driver initialization failures
• Monitor system memory trends on production systems using LiquidIO network adapters

How to Mitigate CVE-2026-23256

Immediate Actions Required

• Update to a patched kernel version that includes the fix for CVE-2026-23256
• Monitor affected systems for signs of memory exhaustion until patches can be applied
• Review system logs for any indication of LiquidIO driver initialization failures

Patch Information

The vulnerability has been addressed in multiple Linux kernel stable branches. The following kernel commits contain the fix:

• Kernel Git Commit 01fbca1
• Kernel Git Commit 3bf519e
• Kernel Git Commit 4640fa5
• Kernel Git Commit 52b19b3
• Kernel Git Commit 6cbba46
• Kernel Git Commit 71a56b8
• Kernel Git Commit bd680e5

Organizations should update to kernel versions containing these commits through their distribution's standard update mechanisms.

Workarounds

• Avoid frequent loading/unloading of the LiquidIO VF driver on affected systems
• If feasible, use Physical Function (PF) configurations instead of VF where possible
• Schedule regular system reboots to reclaim leaked memory on systems that cannot be immediately patched

# Check if LiquidIO driver is loaded
lsmod | grep liquidio

# Check kernel version for patch status
uname -r

# Monitor memory usage on affected systems
watch -n 60 'free -m && cat /proc/meminfo | grep -i slab'