CVE-2026-72329

A flaw was found in the net/liquidio component of the Linux kernel. The Single Root I/O Virtualization (SR-IOV) enable path incorrectly cached Virtual Function (VF) pci_dev pointers. This improper handling of references could lead to a use-after-free vulnerability when the cached pointer is later accessed. A local attacker could potentially leverage this to cause a system crash, leading to a denial of service.

The liquidio PF driver cached VF pci_dev pointers without owning references and later used those pointers when processing an OCTEON_VF_FLR_REQUEST mailbox command. Because the pci_get_device iterator drops the previous device reference, the cached entries can become dangling pointers and a later pcie_flr call may dereference freed or stale PCI device memory. For the CVSS the PR:L is used because the attacker generally needs control of a VF context or a local process that can drive VF mailbox behavior, but full host administrator privileges are not necessarily required in virtualized SR-IOV deployments. The issue is not directly network reachable and is tied to local PCI SR-IOV device access rather than packet traffic. Impact is at least denial of service via host kernel crash and in worst case may allow confidentiality or integrity impact due to a UAF style memory safety flaw, so it should be reviewed manually.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.