CVE-2026-23256: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23256 is an off-by-one error (CWE-193) in the Linux kernel's liquidio network driver affecting the setup_nic_devices() function in the Virtual Function (VF) initialization path. When the initialization loop fails and jumps to the setup_nic_dev_free cleanup label, the cleanup loop (while(i--)) skips the failing index i, resulting in a memory leak. The vulnerability was discovered through code review and disclosed on March 18, 2026. It affects Linux kernel versions from 4.10 through multiple stable branches up to 6.18.x and 6.19 release candidates. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is an off-by-one error (CWE-193) in the cleanup loop within setup_nic_devices() in the Linux kernel's liquidio driver (drivers/net/ethernet/cavium/liquidio/). When device initialization fails at index i and execution jumps to the setup_nic_dev_free label, the existing while(i--) loop decrements i before the first iteration, skipping cleanup of the resource allocated at the failing index. The fix changes the loop to iterate from the current index i down to 0 (inclusive), ensuring all allocated resources are properly freed. The issue requires local access and low privileges to trigger, and was identified purely through code review with no exploit code developed (Red Hat Advisory).

Successful exploitation causes a kernel memory leak in the liquidio driver, leading to gradual memory exhaustion and potential denial of service (system unavailability) through resource depletion. The vulnerability has no confidentiality or integrity impact — only availability is affected. A local attacker with low privileges on a system using the liquidio NIC driver could repeatedly trigger the initialization failure to exhaust kernel memory (Red Hat Advisory).

Patches are available across multiple Linux kernel stable branches. Apply the appropriate update for your kernel version branch:

• 5.10.x: upgrade to 5.10.250 or later
• 5.15.x: upgrade to 5.15.200 or later
• 6.1.x: upgrade to 6.1.163 or later
• 6.6.x: upgrade to 6.6.124 or later
• 6.12.x: upgrade to 6.12.70 or later
• 6.18.x: upgrade to 6.18.10 or later
• 6.19: fixed in the 6.19 release

As a workaround where patching is not immediately possible, restrict local user access on systems running the liquidio driver and monitor for unusual memory consumption. Amazon Linux 2 users can apply ALAS2KERNEL-5.10-2026-114 (Red Hat Advisory, Amazon Linux Advisory).

The vulnerability received routine coverage from Linux security tracking sources including Red Hat, Tenable (Nessus plugin 318847), and Amazon Linux advisories. No notable researcher commentary or significant community discussion has been identified beyond standard vulnerability database entries (Red Hat Advisory).