CVE-2026-23258

Source
https://cve.org/CVERecord?id=CVE-2026-23258
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23258.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-23258
Downstream
Published
2026-03-18T17:41:05.080Z
Modified
2026-03-20T12:47:29.021857Z
Summary
net: liquidio: Initialize netdev pointer before queue setup
Details

In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: Initialize netdev pointer before queue setup

In setupnicdevices(), the netdev is allocated using allocetherdevmq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netifsetrealnumrxqueues() and netifsetrealnumtxqueues().

If either of these functions fails, setupnicdevices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidiodestroynic_device() will fail to find and free the netdev, resulting in a memory leak.

Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors.

Compile tested only. Issue found using a prototype static analysis tool and code review.

Database specific
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/23xxx/CVE-2026-23258.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
c33c997346c34ea7b89aec99524ad9632a2f1e0c
Fixed
be109646cdaecab262f6276303b1763468c94378
Fixed
c81a8515fb8c8fb5d0dbc21f48337494bf1d60df
Fixed
a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4
Fixed
c0ed6c77ec34050971fd0df2a94dfdea66d09331
Fixed
1d4590fde856cb94bd9a46e795c29d8288c238fc
Fixed
d028147ae06407cb355245db1774793600670169
Fixed
926ede0c85e1e57c97d64d9612455267d597bb2c

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23258.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
4.18.0
Fixed
5.10.250
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.200
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.163
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.124
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.12.70
Type
ECOSYSTEM
Events
Introduced
6.13.0
Fixed
6.18.10

Database specific

source
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-23258.json"