CVE-2026-23261: nvme-fc: release admin tagset if init fails
In the Linux kernel, the following vulnerability has been resolved:
nvme-fc: release admin tagset if init fails
nvmefabrics creates an NVMe/FC controller in following path:
nvmfdevwrite() -> nvmfcreatectrl() -> nvmefccreatectrl() -> nvmefcinitctrl()
nvmefcinitctrl() allocates the admin blk-mq resources right after nvmeaddctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the failctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc.
Check ctrl->ctrl.admintagset in the failctrl path and call nvmeremoveadmintagset() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2026-23261?
CVE-2026-23261 has a medium severity rating due to its potential impact on the NVMe/FC controller functionality.
How do I fix CVE-2026-23261?
To fix CVE-2026-23261, update your Linux kernel to the latest stable version that includes the patch addressing this vulnerability.
What systems are affected by CVE-2026-23261?
CVE-2026-23261 affects systems running the Linux kernel that utilize NVMe over Fibre Channel interfaces.
What are the risks of not addressing CVE-2026-23261?
Not addressing CVE-2026-23261 may lead to potential system instability and improper handling of NVMe/FC controllers, which could compromise data integrity.
When was CVE-2026-23261 reported?
CVE-2026-23261 was reported as a vulnerability in the Linux kernel affecting NVMe/FC functionality.