CVE-2026-23257: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23257 is an off-by-one error (CWE-193) in the Linux kernel's liquidio network driver that causes a memory leak during NIC device initialization failures. The vulnerability exists in the setup_nic_devices() function of the PF (Physical Function) driver, where the cleanup loop while(i--) skips the failing index, leaving allocated memory unreleased. It affects Linux kernel versions from 4.2 up to (but not including) 5.10.250, 5.11–5.15.200, 5.16–6.1.163, 6.2–6.6.124, 6.7–6.12.70, and 6.13–6.18.10, as well as release candidates 6.19-rc1 through 6.19-rc8. Disclosed on March 18, 2026, it carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat CVE, Feedly).

The root cause is an off-by-one error (CWE-193) in the cleanup path of setup_nic_devices() within the Linux kernel's net/ethernet/cavium/liquidio driver. When the initialization loop encounters a failure and jumps to the setup_nic_dev_free label, the cleanup loop while(i--) decrements i before using it, causing it to skip freeing the resources allocated at the current (failing) index. Additionally, the devlink_alloc failure path does not decrement i to point to the last successfully allocated index before entering cleanup, compounding the leak. The issue was discovered through code review rather than dynamic testing, and no proof-of-concept exploit code exists (Red Hat CVE, Linux Kernel CVE Announce).

Successful exploitation results in incremental memory leaks on systems running affected Linux kernel versions with Cavium LiquidIO network adapters. Each failed NIC device initialization cycle leaks kernel memory, which over time can exhaust available memory, degrading system stability and availability. There is no confidentiality or integrity impact; the vulnerability is limited to availability (denial of service via memory exhaustion), and exploitation requires local access with low privileges (Red Hat CVE, Feedly).

There is no known public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the time of this report. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.024% (0.000240), reflecting a very low probability of exploitation in the near term. Exploitation requires local access with low privileges and is only relevant on systems equipped with Cavium LiquidIO hardware undergoing repeated initialization/failure cycles (Red Hat CVE, Feedly).

Patches are available across multiple Linux kernel stable branches. Users should update to the following fixed versions: 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, or 6.19 (mainline). Reference commits are available in the Linux kernel stable repository. For systems that cannot be immediately patched, limiting device insertion/removal cycles for liquidio adapters and monitoring kernel memory usage (e.g., via /proc/meminfo or dmesg for memory pressure warnings) can help reduce impact (Red Hat CVE, Amazon Linux Advisory).