CVE-2026-72023 in Linux
Summary
by MITRE • 08/15/2026
In the Linux kernel, the following vulnerability has been resolved:
octeontx2-pf: fix SQB pointer leak on init failure
otx2_init_hw_resources() initializes SQ aura and pool resources before several later setup steps. On failure, err_free_sq_ptrs only frees SQB pages, leaving the per-SQ sqb_ptrs arrays behind.
Use otx2_free_sq_res() for the SQ unwind path and let it free sqb_ptrs even when sq->sqe has not been allocated yet.
The bug was first flagged by an experimental analysis tool we are developing for kernel memory-management bugs while analyzing v6.13-rc1. The tool is still under development and is not yet publicly available. Manual inspection confirms that the bug is still present in v7.1.1.
An x86_64 allyesconfig build showed no new warnings. As we do not have an OcteonTX2 PF device and the corresponding AF mailbox setup to test with, no runtime testing was able to be performed.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/16/2026
The vulnerability identified in the Linux kernel represents a memory management flaw within the octeontx2-pf driver that specifically affects the initialization sequence of SQB (Send Queue Buffer) resources. This issue manifests as a pointer leak occurring during hardware resource initialization failure scenarios, where the system fails to properly release allocated memory structures, leading to potential resource exhaustion over time.
The technical flaw resides in the otx2_init_hw_resources() function which performs sequential initialization of SQ aura and pool resources before executing subsequent setup operations. When initialization encounters a failure condition, the error handling path executes err_free_sq_ptrs() which only frees SQB pages but neglects to release the per-SQ sqb_ptrs arrays that were allocated during the initialization sequence. This partial cleanup creates a memory leak where the sqb_ptrs arrays remain allocated in kernel memory even though the overall resource initialization has failed.
According to CWE classification, this vulnerability maps to CWE-401: Improper Release of Memory Before Removing Last Reference, which specifically addresses situations where memory resources are not properly freed during error handling paths. The flaw demonstrates a classic case of resource management failure where cleanup operations fail to account for all allocated structures within a complex initialization sequence.
The operational impact of this vulnerability extends beyond simple memory consumption as it represents a potential denial-of-service vector in systems running multiple initialization cycles or under heavy workload conditions. The leak occurs during the hardware initialization phase, meaning that each failed initialization attempt contributes to progressive memory fragmentation and eventual resource exhaustion. This is particularly concerning for high-performance network environments where the octeontx2-pf driver handles critical packet processing operations.
The fix implemented addresses this by modifying the SQ unwind path to utilize otx2_free_sq_res() function which properly handles cleanup of sqb_ptrs arrays even when the sq->sqe structure has not yet been allocated. This comprehensive cleanup ensures that all memory allocations within the SQ resource management context are properly released regardless of where initialization failure occurs. The vulnerability was initially detected through an experimental kernel memory-management analysis tool, demonstrating the importance of automated static analysis in identifying subtle memory management bugs.
The patch maintains compatibility with existing system configurations as evidenced by the x86_64 allyesconfig build showing no new warnings, indicating that the fix does not introduce regressions in functionality or performance. However, the absence of runtime testing on actual OcteonTX2 PF devices represents a limitation in validation, though the fix's approach aligns with established kernel memory management practices for error recovery paths. This type of vulnerability falls under ATT&CK technique T1499.004: Endpoint Denial of Service - Network Denial of Service, as it can lead to system instability through resource exhaustion during normal operation.
The vulnerability highlights the complexity of proper error handling in kernel drivers where multiple resource allocation steps must be carefully coordinated with corresponding deallocation paths. The fix demonstrates a robust approach to resource management that ensures complete cleanup regardless of failure points within initialization sequences, aligning with best practices for secure kernel development and memory safety protocols.