CVE-2026-23164

What it actually does

The flaw allocates wpriv memory via kzalloc in rocker_world_port_pre_init but only frees it in rocker_world_port_post_fini when the port_post_fini callback is non-NULL; rocker_ofdpa_ops leaves the callback NULL, so sizeof(struct ofdpa_port) bytes leak on every port removal.

Why it matters to the business

Repeated port or device removal operations cause gradual kernel memory exhaustion that can lead to system instability or denial of service; the affected code path appears in nvidia/megatron-lm GIT deployments.

How an attack unfolds

A local attacker repeatedly initializes and tears down rocker ports that use ofdpa operations, triggering allocations that are never freed and steadily consuming memory until the system OOMs.

How to fix it

Update nvidia/megatron-lm (GIT) to commit 3ea68ad6042cc1204386ae9364358f7c4de1bc37 or newer; rebuild and deploy the kernel module containing the unconditional kfree in rocker_world_port_post_fini.

How to confirm the fix worked

Confirm the fixed commit is present in the running kernel tree and that kfree(rocker_port->wpriv) executes regardless of the port_post_fini callback value; test repeated port add/remove cycles while monitoring slab memory usage.

Typical attack path

1. Obtain local access on a system running the vulnerable rocker driver
2. Trigger port initialization through the ofdpa world operations
3. Cause port removal to leak wpriv memory
4. Repeat the cycle to accumulate leaks until memory pressure triggers OOM

How to detect it

Review kernel logs for repeated rocker port removal events and correlate with rising slab or kmalloc memory consumption that lacks matching frees; watch for OOM killer invocations on systems using the driver.

What your security team should do

• Apply the referenced commit to nvidia/megatron-lm deployments immediately
• Restrict local unprivileged access on hosts that load the rocker driver
• Add kernel memory usage alerts for systems exposing rocker ports