PT-2026-26121 · Linux · Linux

Published 2026-03-18 · Updated 2026-03-18 · CVE-2026-23261

NVD

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme fabrics creates an NVMe/FC controller in following path:

nvmf dev write() -> nvmf create ctrl() -> nvme fc create ctrl() -> nvme fc init ctrl()

nvme fc init ctrl() allocates the admin blk-mq resources right after nvme add ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin tagset in the fail ctrl path and call nvme remove admin tag set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.

Related Identifiers

CVE-2026-23261

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-23261 · Security Note
• https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3 · Note
• https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8 · Note
• https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea · Note
• https://git.kernel.org/stable/c/b134dead095bc5a58fa2b98b90ae93428cb4b328 · Note
• https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01 · Note