{"id":"CVE-2026-23261","title":"nvme-fc: release admin tagset if init fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n    nvmf_dev_write()\n      -> nvmf_create_ctrl()\n        -> …","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 5fe335a80548e2eda5d51fab801108b323600e95 < 7c54d3f5ebbc5982daaa004260242dc07ac943ea","Linux >= 17c3a66d7ea2d303f783796d62f99e2e23b68c90 < fa301aef50e3f3b5be6ee53457608beae5aa7a01","Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < e810b290922c535feb34bc90ab549446fe94d2a3","Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < d1877cc7270302081a315a81a0ee8331f19f95c8","Linux 0d1840b2dd8fe073c020c39bf8e8e89488070801","Linux >= 6.6.118 < 6.6.124","Linux >= 6.12.60 < 6.12.70","Linux >= 6.17.10 < 6.18","Linux 6.18"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-05T21:24:22.816379Z"},"published":"2026-03-18","updated":"2026-11-05","sourceUpdated":"2026-11-05T21:33:34.419Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23261","references":[{"url":"https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea"},{"url":"https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01"},{"url":"https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3"},{"url":"https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8"}],"tags":["cve.org"],"epss":0.00121,"epssPercentile":0.01913,"ingestedAt":"2026-11-05T22:38:32.107Z","slug":"CVE-2026-23261","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n    nvmf_dev_write()\n      -> nvmf_create_ctrl()\n        -> nvme_fc_create_ctrl()\n          -> nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() allocates the admin blk-mq resources right after\nnvme_add_ctrl() succeeds.  If any of the subsequent steps fail (changing\nthe controller state, scheduling connect work, etc.), we jump to the\nfail_ctrl path, which tears down the controller references but never\nfrees the admin queue/tag set.  The leaked blk-mq allocations match the\nkmemleak report seen during blktests nvme/fc.\n\nCheck ctrl->ctrl.admin_tagset in the fail_ctrl path and call\nnvme_remove_admin_tag_set() when it is set so that all admin queue\nallocations are reclaimed whenever controller setup aborts.\n\n## Affected\n\n- `Linux >= 5fe335a80548e2eda5d51fab801108b323600e95 < 7c54d3f5ebbc5982daaa004260242dc07ac943ea`\n- `Linux >= 17c3a66d7ea2d303f783796d62f99e2e23b68c90 < fa301aef50e3f3b5be6ee53457608beae5aa7a01`\n- `Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < e810b290922c535feb34bc90ab549446fe94d2a3`\n- `Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < d1877cc7270302081a315a81a0ee8331f19f95c8`\n- `Linux 0d1840b2dd8fe073c020c39bf8e8e89488070801`\n- `Linux >= 6.6.118 < 6.6.124`\n- `Linux >= 6.12.60 < 6.12.70`\n- `Linux >= 6.17.10 < 6.18`\n- `Linux 6.18`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}