CVE-2026-23258None▾ SunlitIn the Linux kernel, the following vulnerability has been resolved: net: liquidio: Initialize netdev pointer before queue setup In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this str…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.
Exploit-prediction probability, daily snapshots since Nov 5.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
Last analysed / modified upstream
0.1%
In the Linux kernel, the following vulnerability has been resolved:
net: liquidio: Initialize netdev pointer before queue setup
In setup_nic_devices(), the netdev is allocated using alloc_etherdev_mq(). However, the pointer to this structure is stored in oct->props[i].netdev only after the calls to netif_set_real_num_rx_queues() and netif_set_real_num_tx_queues().
If either of these functions fails, setup_nic_devices() returns an error without freeing the allocated netdev. Since oct->props[i].netdev is still NULL at this point, the cleanup function liquidio_destroy_nic_device() will fail to find and free the netdev, resulting in a memory leak.
Fix this by initializing oct->props[i].netdev before calling the queue setup functions. This ensures that the netdev is properly accessible for cleanup in case of errors.
Compile tested only. Issue found using a prototype static analysis tool and code review.
Linux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < be109646cdaecab262f6276303b1763468c94378Linux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < c81a8515fb8c8fb5d0dbc21f48337494bf1d60dfLinux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < a0e57c0b68c9e6f9a8fd7c1167861a5a730eb2f4Linux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < c0ed6c77ec34050971fd0df2a94dfdea66d09331Linux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < 1d4590fde856cb94bd9a46e795c29d8288c238fcLinux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < d028147ae06407cb355245db1774793600670169Linux >= c33c997346c34ea7b89aec99524ad9632a2f1e0c < 926ede0c85e1e57c97d64d9612455267d597bb2cLinux 4.18Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99284Nonenet: skbuff: propagate shared-frag marker in skb_zerocopy()
CVE-2026-99283Nonenetfilter: conntrack: tcp: use UNACK timeout for non-closing RST packets
CVE-2026-99272Nonesmb: client: validate the data area in SMB2_read()
CVE-2026-99271NoneALSA: line6: Clear prev_fbuf on capture buffer release
CVE-2026-99273Noneksmbd: reserve space for the UTF-16 terminator in stream info
CVE-2026-99275Nonesmb: client: reject short SESSION_SETUP responses