CVE-2026-90233: nvme-pci: release descriptor pools on probe failure
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: release descriptor pools on probe failure
The per-NUMA-node descriptor DMA pools are created lazily from nvmeinithctxcommon() once the admin tag set is allocated, but they are only destroyed in nvmeremove() via nvmereleasedescriptorpools(). Any probe failure after the admin tag set has been allocated unwinds through the outdisable label and nvmepcifreectrl(), neither of which releases the pools, leaking the dmapool objects.
Release the descriptor pools in the outdisable error path. It must not be added to nvmepcifreectrl(), as that would double-free against nvmeremove() on the normal teardown path.
Affected Software
Event History
Frequently Asked Questions
When can this leak occur?
It occurs when NVMe PCI controller probing fails after the admin tag set has been allocated. In that failure path, lazily created per-NUMA-node descriptor DMA pools were not released.
Does normal controller removal trigger the same issue?
No. Normal teardown uses nvme_remove(), which already releases the descriptor pools. The fix is specifically placed in the probe failure out_disable path to avoid double-freeing pools during normal removal.
What is the practical impact of repeated failed probes?
Repeated qualifying probe failures can leak dma_pool objects for descriptor pools. The provided information describes a resource leak and does not indicate data exposure, privilege escalation, or code execution.