---
id: CVE-2026-23261
title: 'nvme-fc: release admin tagset if init fails'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-fc: release admin tagset if init fails

  nvme_fabrics creates an NVMe/FC controller in following path:

      nvmf_dev_write()
        -> nvmf_create_ctrl()
          -> …
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 5fe335a80548e2eda5d51fab801108b323600e95 <
    7c54d3f5ebbc5982daaa004260242dc07ac943ea
  - >-
    Linux >= 17c3a66d7ea2d303f783796d62f99e2e23b68c90 <
    fa301aef50e3f3b5be6ee53457608beae5aa7a01
  - >-
    Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 <
    e810b290922c535feb34bc90ab549446fe94d2a3
  - >-
    Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 <
    d1877cc7270302081a315a81a0ee8331f19f95c8
  - Linux 0d1840b2dd8fe073c020c39bf8e8e89488070801
  - Linux >= 6.6.118 < 6.6.124
  - Linux >= 6.12.60 < 6.12.70
  - Linux >= 6.17.10 < 6.18
  - Linux 6.18
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-05T21:24:22.816379Z'
published: '2026-03-18'
updated: '2026-11-05'
sourceUpdated: '2026-11-05T21:33:34.419Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23261'
references:
  - url: 'https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea'
  - url: 'https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01'
  - url: 'https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3'
  - url: 'https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8'
tags:
  - cve.org
epss: 0.00121
epssPercentile: 0.01913
ingestedAt: '2026-11-05T22:38:32.107Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme_fabrics creates an NVMe/FC controller in following path:

    nvmf_dev_write()
      -> nvmf_create_ctrl()
        -> nvme_fc_create_ctrl()
          -> nvme_fc_init_ctrl()

nvme_fc_init_ctrl() allocates the admin blk-mq resources right after
nvme_add_ctrl() succeeds.  If any of the subsequent steps fail (changing
the controller state, scheduling connect work, etc.), we jump to the
fail_ctrl path, which tears down the controller references but never
frees the admin queue/tag set.  The leaked blk-mq allocations match the
kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call
nvme_remove_admin_tag_set() when it is set so that all admin queue
allocations are reclaimed whenever controller setup aborts.

## Affected

- `Linux >= 5fe335a80548e2eda5d51fab801108b323600e95 < 7c54d3f5ebbc5982daaa004260242dc07ac943ea`
- `Linux >= 17c3a66d7ea2d303f783796d62f99e2e23b68c90 < fa301aef50e3f3b5be6ee53457608beae5aa7a01`
- `Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < e810b290922c535feb34bc90ab549446fe94d2a3`
- `Linux >= ea3442efabd0aa3930c5bab73c3901ef38ef6ac3 < d1877cc7270302081a315a81a0ee8331f19f95c8`
- `Linux 0d1840b2dd8fe073c020c39bf8e8e89488070801`
- `Linux >= 6.6.118 < 6.6.124`
- `Linux >= 6.12.60 < 6.12.70`
- `Linux >= 6.17.10 < 6.18`
- `Linux 6.18`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.