CVE-2026-72038: net: liquidio: fix BAR resource leak on PF number failure

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: liquidio: fix BAR resource leak on PF number failure

If cn23xx_get_pf_num() fails, the function returns without
unmapping either BAR. Unmap both BARs before returning from
the error path.

Found by manual code review.

The Linux kernel CVE team has assigned CVE-2026-72038 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 5.10.261 with commit 75b924759de9427761115301308c137904aa3f99
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 5.15.212 with commit 4a45884566bab4122bbeb8fff7d2d6b5fdbded24
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 6.1.178 with commit 020e52aee732bb08e6b89dd02bbf88895a50fffd
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 6.6.145 with commit b74f293e5f38052cfa14710abfacd6b6561cc2d6
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 6.12.97 with commit a22103618ee5b6ee884c374351f65fcdff7248f0
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 6.18.40 with commit 715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 7.1.5 with commit 4140c516473a0e116ab3a73f9320c2aa5800210b
	Issue introduced in 4.14 with commit 0c45d7fe12c7e1510bae9dfac189c8b927e4636b and fixed in 7.2-rc2 with commit c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-72038
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/cavium/liquidio/cn23xx_pf_device.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/75b924759de9427761115301308c137904aa3f99
	https://git.kernel.org/stable/c/4a45884566bab4122bbeb8fff7d2d6b5fdbded24
	https://git.kernel.org/stable/c/020e52aee732bb08e6b89dd02bbf88895a50fffd
	https://git.kernel.org/stable/c/b74f293e5f38052cfa14710abfacd6b6561cc2d6
	https://git.kernel.org/stable/c/a22103618ee5b6ee884c374351f65fcdff7248f0
	https://git.kernel.org/stable/c/715cce38424fb2488ef2c5e6e6ffbfe1b74a9e67
	https://git.kernel.org/stable/c/4140c516473a0e116ab3a73f9320c2aa5800210b
	https://git.kernel.org/stable/c/c63ee62a3c4ac1a1542f4c1a4b87e2f41df5a496