LiveActive security incident?Get immediate response
CVE Record

CVE-2026-23261: nvme-fc: release admin tagset if init fails

In the Linux kernel, the following vulnerability has been resolved: nvme-fc: release admin tagset if init fails nvme_fabrics creates an NVMe/FC controller in following path: nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl() nvme_fc_init_ctrl() allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq allocations match the kmemleak report seen during blktests nvme/fc. Check ctrl->ctrl.admin_tagset in the fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are reclaimed whenever controller setup aborts.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysislow

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel NVMe over Fibre Channel cleanup bug. When controller creation fails partway through, some admin queue resources may not be released. The practical concern is wasted kernel memory or related resource pressure on systems using NVMe/FC, not confirmed data theft or remote compromise.

Executive priority

Treat this as routine kernel maintenance unless critical storage hosts use NVMe/FC and show repeated setup failures. No active exploitation is cited, but storage infrastructure should receive timely vendor kernel updates.

Technical view

The nvme-fc path can allocate admin blk-mq resources after nvme_add_ctrl() succeeds, then take a fail_ctrl path without freeing ctrl->ctrl.admin_tagset. The fix calls nvme_remove_admin_tag_set() when admin_tagset exists, reclaiming allocations after aborted controller initialization.

Likely exposure

Exposure appears limited to Linux systems using NVMe over Fibre Channel where controller setup can fail after admin tagset allocation. Systems not using nvme-fc are unlikely to be exposed based on the provided description.

Exploitation context

CISA KEV status is false, and the provided sources do not report active exploitation. The evidence describes a resource leak found during blktests nvme/fc, not a public exploit chain.

Researcher notes

The source data lacks CVSS, CWE, and precise distribution package mapping. The described impact is leaked blk-mq admin queue allocations on initialization failure. Avoid expanding impact beyond resource leakage without additional vendor analysis.

Mitigation direction

  • Apply Linux stable or distribution kernel updates containing the referenced fixes.
  • Prioritize systems using NVMe over Fibre Channel.
  • Check vendor advisories for exact affected and fixed package versions.
  • Monitor affected hosts for repeated NVMe/FC controller setup failures.
  • Avoid direct wrangler or deployment assumptions; this is kernel remediation work.

Validation and detection

  • Inventory Linux kernel versions on hosts using NVMe/FC.
  • Confirm whether nvme-fc is enabled or loaded on relevant systems.
  • Compare kernel builds against CVE affected and fixed version data.
  • Review kernel logs for NVMe/FC controller initialization failures.
  • Use vendor kernel changelogs to confirm the fix is included.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-23261 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux5fe335a80548e2eda5d51fab801108b323600e95, 17c3a66d7ea2d303f783796d62f99e2e23b68c90, ea3442efabd0aa3930c5bab73c3901ef38ef6ac3, ea3442efabd0aa3930c5bab73c3901ef38ef6ac3, 0d1840b2dd8fe073c020c39bf8e8e89488070801, 6.6.118, 6.12.60, 6.17.10unaffected
LinuxLinux6.18, 0, 6.6.124, 6.12.70, 6.18.10, 6.19affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.