CVE-2026-72038 - Vulnerability Details

- net: liquidio: fix BAR resource leak on PF number failure

Description

In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: fix BAR resource leak on PF number failure

If cn23xx_get_pf_num() fails, the function returns without
unmapping either BAR. Unmap both BARs before returning from
the error path.

Found by manual code review.

Published: 2026-08-15

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< 75b924759de9427761115301308c137904aa3f99
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< 4a45884566bab4122bbeb8fff7d2d6b5fdbded24
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< 020e52aee732bb08e6b89dd02bbf88895a50fffd
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< b74f293e5f38052cfa14710abfacd6b6561cc2d6
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< a22103618ee5b6ee884c374351f65fcdff7248f0
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< 715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< 4140c516473a0e116ab3a73f9320c2aa5800210b
`0c45d7fe12c7e1510bae9dfac189c8b927e4636b`	affected	< c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,75b924759de9427761115301308c137904aa3f99)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,4a45884566bab4122bbeb8fff7d2d6b5fdbded24)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,020e52aee732bb08e6b89dd02bbf88895a50fffd)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,b74f293e5f38052cfa14710abfacd6b6561cc2d6)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,a22103618ee5b6ee884c374351f65fcdff7248f0)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,4140c516473a0e116ab3a73f9320c2aa5800210b)`	affected	code_commit	—
`[0c45d7fe12c7e1510bae9dfac189c8b927e4636b,c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	generic	—
`[0,4.14)`	unaffected	generic	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc2,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8876-1	Linux kernel (Azure CVM) vulnerabilities
Ubuntu USN	USN-8875-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8877-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8887-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8888-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8889-1	Linux kernel (OEM) vulnerabilities
Ubuntu USN	USN-8887-2	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8888-2	Linux kernel (Azure) vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.0022.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/020e52aee732bb08e6b89dd02bbf88895a50fffd
https://git.kernel.org/stable/c/4140c516473a0e116ab3a73f9320c2aa5800210b
https://git.kernel.org/stable/c/4a45884566bab4122bbeb8fff7d2d6b5fdbded24
https://git.kernel.org/stable/c/715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67
https://git.kernel.org/stable/c/75b924759de9427761115301308c137904aa3f99
https://git.kernel.org/stable/c/a22103618ee5b6ee884c374351f65fcdff7248f0
https://git.kernel.org/stable/c/b74f293e5f38052cfa14710abfacd6b6561cc2d6
https://git.kernel.org/stable/c/c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496
https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72038-8eaa@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-72038
https://www.cve.org/CVERecord?id=CVE-2026-72038

History

Tue, 18 Aug 2026 04:45:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-464 CWE-471

Tue, 18 Aug 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-772
References		https://lore.kernel.org/linux-cve-announce/2026081513-CVE-2026-72038-8eaa@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-72038 https://www.cve.org/CVERecord?id=CVE-2026-72038
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Sat, 15 Aug 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-464 CWE-471

Sat, 15 Aug 2026 06:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: liquidio: fix BAR resource leak on PF number failure If cn23xx_get_pf_num() fails, the function returns without unmapping either BAR. Unmap both BARs before returning from the error path. Found by manual code review.
Title		net: liquidio: fix BAR resource leak on PF number failure
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/020e52aee732bb08e6b89dd02bbf88895a50fffd https://git.kernel.org/stable/c/4140c516473a0e116ab3a73f9320c2aa5800210b https://git.kernel.org/stable/c/4a45884566bab4122bbeb8fff7d2d6b5fdbded24 https://git.kernel.org/stable/c/715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67 https://git.kernel.org/stable/c/75b924759de9427761115301308c137904aa3f99 https://git.kernel.org/stable/c/a22103618ee5b6ee884c374351f65fcdff7248f0 https://git.kernel.org/stable/c/b74f293e5f38052cfa14710abfacd6b6561cc2d6 https://git.kernel.org/stable/c/c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-08-15T05:51:58.487Z

Updated: 2026-08-17T05:07:04.031Z

Reserved: 2026-08-09T03:40:39.901Z

Link: CVE-2026-72038

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-08-15T06:21:12.860

Modified: 2026-08-17T06:18:01.700

Link: CVE-2026-72038

Redhat

Severity : Low

Publid Date: 2026-08-15T00:00:00Z

Links: CVE-2026-72038 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-18T05:30:08Z

Weaknesses

CWE-772
Missing Release of Resource after Effective Lifetime

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object