LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23258: net: liquidio: Initialize netdev pointer before queue setup

In the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak. Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors. Compile tested only. Issue found using a prototype static analysis tool and code review.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

CVE-2026-23258 is a Linux kernel memory leak in the liquidio network driver setup path. If queue setup fails, an allocated network device may not be freed. The source describes a cleanup reliability issue, not data theft or remote code execution. No active exploitation is cited.

Executive priority

Treat as routine kernel maintenance unless liquidio-backed network devices are important in your fleet. There is no cited exploitation and the known impact is a memory leak, but affected infrastructure should still receive normal kernel updates.

Technical view

In setup_nic_devices(), alloc_etherdev_mq() allocates netdev before netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues(). The pointer is stored later, so failure before assignment leaves cleanup unable to free netdev. The fix assigns oct->props[i].netdev before queue setup. The report says compile-tested only.

Likely exposure

Exposure appears limited to Linux systems using affected kernels with the liquidio driver path present. The bundle lists Linux kernel versions as affected, but does not provide distribution package mappings or runtime prerequisites beyond the driver code path.

Exploitation context

The source bundle does not cite KEV listing, public exploitation, exploit code, or weaponization. The described trigger is an error path during NIC queue setup that causes memory not to be released.

Researcher notes

Evidence is narrow and code-specific. The CVE describes a static-analysis and code-review finding, compile-tested only. There is no CVSS, CWE, distribution advisory detail, or proof of exploitability in the provided bundle.

Mitigation direction

  • Update to a kernel containing the referenced stable fix commits.
  • Follow Linux distribution or vendor kernel advisories for package-specific fixed versions.
  • Prioritize systems using affected kernels and the liquidio driver.
  • If patching is delayed, monitor vendor guidance; no separate mitigation is named.

Validation and detection

  • Inventory Linux hosts against the affected kernel versions in the CVE record.
  • Confirm whether the liquidio driver is built, loaded, or required on each host.
  • Verify the vendor kernel package includes the referenced stable fix.
  • Review kernel logs for repeated liquidio device setup failures or resource pressure.
Prepared
Confidence
medium
Sources
9

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23258 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
8Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinuxc33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0c, c33c997346c34ea7b89aec99524ad9632a2f1e0cunaffected
LinuxLinux4.18, 0, 5.10.250, 5.15.200, 6.1.163, 6.6.124, 6.12.70, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.