CVE-2026-23261

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

nvme-fc: release admin tagset if init fails

nvme_fabrics creates an NVMe/FC controller in following path:

nvmf_dev_write()

-> nvmf_create_ctrl()

-> nvme_fc_create_ctrl()

-> nvme_fc_init_ctrl()

nvme_fc_init_ctrl() allocates the admin blk-mq resources right after

nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing

the controller state, scheduling connect work, etc.), we jump to the

fail_ctrl path, which tears down the controller references but never

frees the admin queue/tag set. The leaked blk-mq allocations match the

kmemleak report seen during blktests nvme/fc.

Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call

nvme_remove_admin_tag_set() when it is set so that all admin queue

allocations are reclaimed whenever controller setup aborts.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References