CVE-2026-23256

A memory leak was found in the Linux kernel's LiquidIO network driver for Virtual Functions (VF). In setup_nic_devices(), when initialization fails, the cleanup loop uses while(i--) which skips freeing resources at the failing index i due to an off-by-one error. This causes memory to leak on each initialization failure.

This flaw affects systems using Cavium LiquidIO network adapters with SR-IOV Virtual Functions. The memory leak occurs only in error handling paths during VF device setup. The issue was found through code review and compile-tested only, indicating it may be difficult to trigger in practice. Repeated VF initialization failures could gradually consume kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the liquidio_vf module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.