CVE-2026-23257

A memory leak was found in the Linux kernel's LiquidIO network driver for Physical Functions (PF). In setup_nic_devices(), when initialization fails, the cleanup loop uses while(i--) which skips freeing resources at the failing index i due to an off-by-one error. Additionally, the devlink_alloc failure path did not properly decrement the index pointer, causing similar leaks.

This flaw affects systems using Cavium LiquidIO network adapters. The memory leak occurs only in error handling paths during PF device setup. The issue was found through code review and compile-tested only. Like the VF variant (CVE-2026-23256), this requires repeated initialization failures to have noticeable impact and does not lead to crashes or code execution.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

To mitigate this issue, prevent the liquidio module from being loaded. See https://access.redhat.com/solutions/41278 for instructions.