CVE-2026-23261 Linux CVE debrief

Who should care

Linux kernel maintainers, distribution integrators, storage/platform teams running NVMe over Fibre Channel, and operators who validate kernel stability or memory/resource accounting on affected systems.

Technical summary

According to the CVE description, `nvme_fabrics` creates an NVMe/FC controller through `nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl()`. `nvme_fc_init_ctrl()` allocates admin blk-mq resources immediately after `nvme_add_ctrl()` succeeds. If later setup steps fail, execution reaches `fail_ctrl`, which cleans up controller references but does not free the admin tagset. The fix described is to check `ctrl->ctrl.admin_tagset` in `fail_ctrl` and call `nvme_remove_admin_tag_set()` so the admin queue allocations are reclaimed on abort.

Defensive priority

Medium

Recommended defensive actions

• Apply or backport the upstream Linux kernel fix referenced by the official stable.kernel.org commit links in the CVE record.
• Review NVMe/FC controller setup failure handling in your kernel build or backport stack to confirm admin tagset cleanup is present.
• If you validate storage kernels with blktests, include `nvme/fc` coverage to catch resource leaks in controller-abort paths.
• Monitor kernel logs and memory/resource diagnostics for leaked blk-mq allocations after failed NVMe/FC controller initialization.
• Treat the issue as a reliability and resource-management bug rather than an exploit-focused advisory, and prioritize it where NVMe/FC is deployed.

Evidence notes

The supplied CVE text states that `nvme_fc_init_ctrl()` allocates admin blk-mq resources after `nvme_add_ctrl()` succeeds and that later failures can leave `ctrl->ctrl.admin_tagset` uncleared in `fail_ctrl`, producing leaked allocations observed by kmemleak during blktests `nvme/fc`. The source record also lists four official `git.kernel.org` stable commit URLs as references. No CVSS score/vector was provided in the supplied data, and NVD marks the item as undergoing analysis.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.