CVE-2026-23258 Overview
CVE-2026-23258 is a memory leak vulnerability in the Linux kernel's liquidio network driver. The flaw exists in the setup_nic_devices() function, where a netdev structure is allocated via alloc_etherdev_mq() but the pointer is not stored in oct->props[i].netdev until after queue setup completes. If netif_set_real_num_rx_queues() or netif_set_real_num_tx_queues() fails, the function returns an error without freeing the allocated netdev. The cleanup function liquidio_destroy_nic_device() cannot free the structure because the pointer reference is still NULL. The issue was identified through static analysis and code review, and a fix has been merged into the kernel stable tree.
Critical Impact
Memory leak in the Linux kernel liquidio driver during NIC initialization failures, potentially leading to kernel memory exhaustion over time on affected systems.
Affected Products
- Linux kernel versions containing the liquidio driver prior to the fix
- Systems using Cavium LiquidIO network adapters
- Linux distributions tracking mainline and stable kernel branches
Discovery Timeline
- 2026-03-18 - CVE-2026-23258 published to NVD
- 2026-03-19 - Last updated in NVD database
Technical Details for CVE-2026-23258
Vulnerability Analysis
The vulnerability resides in setup_nic_devices() within the Linux kernel liquidio driver. The function allocates a network device structure using alloc_etherdev_mq() and then proceeds to configure the receive and transmit queues. The assignment of the allocated pointer to oct->props[i].netdev occurs only after queue configuration succeeds.
When netif_set_real_num_rx_queues() or netif_set_real_num_tx_queues() returns an error, control flow exits the initialization path without releasing the allocated structure. The driver's cleanup routine, liquidio_destroy_nic_device(), relies on oct->props[i].netdev being a valid pointer to perform deallocation. Because the pointer remains NULL, the allocated memory becomes unreachable.
Root Cause
The root cause is an ordering bug in resource tracking. The driver registers the allocated netdev with its parent tracking structure after performing fallible operations on that same netdev. This violates the principle that resource handles should be tracked immediately after allocation to ensure error paths can release them.
Attack Vector
Triggering the leak requires conditions that cause queue setup to fail during NIC initialization. This is generally not remotely exploitable and falls into the category of a reliability and resource exhaustion defect rather than a directly weaponizable flaw. Repeated initialization failures on systems with liquidio hardware could exhaust kernel memory over time.
No verified public exploitation code exists. The vulnerability mechanism is described in the upstream commits referenced in the kernel stable tree.
Detection Methods for CVE-2026-23258
Indicators of Compromise
- Kernel log entries showing repeated liquidio initialization failures referencing netif_set_real_num_rx_queues or netif_set_real_num_tx_queues
- Gradual reduction of available kernel slab memory on systems with Cavium LiquidIO adapters
- kmemleak reports identifying unreferenced allocations originating from alloc_etherdev_mq in the liquidio driver
Detection Strategies
- Enable CONFIG_DEBUG_KMEMLEAK on test systems to surface unreferenced allocations from setup_nic_devices()
- Review kernel package versions against distribution security trackers to confirm whether the fix is applied
- Audit dmesg for driver initialization errors that correlate with the affected code path
Monitoring Recommendations
- Track kernel Slab and SUnreclaim values in /proc/meminfo for unexplained growth on hosts using liquidio hardware
- Forward kernel logs to a centralized log platform and alert on repeated liquidio driver errors
- Inventory hosts containing Cavium LiquidIO NICs to prioritize patch deployment
How to Mitigate CVE-2026-23258
Immediate Actions Required
- Apply the upstream kernel fix referenced in the stable tree commits and rebuild affected kernels
- Update to a distribution kernel package that includes the backport once vendors publish fixed versions
- Schedule reboots on systems with liquidio adapters after patched kernels are installed
Patch Information
The fix initializes oct->props[i].netdev before invoking the queue setup functions, ensuring the cleanup path in liquidio_destroy_nic_device() can release the allocated structure on failure. Relevant upstream commits include 1d4590f, 926ede0, a0e57c0, be10964, c0ed6c7, c81a851, and d028147.
Workarounds
- Unload the liquidio module on systems that do not use Cavium LiquidIO adapters using modprobe -r liquidio
- Blacklist the driver where the hardware is not present to prevent loading at boot
- Monitor kernel memory usage and reboot affected hosts if exhaustion is observed before a patched kernel is deployed
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
