CVE-2026-23261
Description
A memory leak was found in the Linux kernel's NVMe over Fibre Channel (NVMe-FC) driver. In nvme_fc_init_ctrl(), when controller initialization fails after admin blk-mq resources are allocated, the fail_ctrl error path does not free the admin queue tagset. This causes blk-mq allocations to leak, as detected by kmemleak during blktests nvme/fc testing.
Statement
This flaw affects systems using NVMe over Fibre Channel storage. The memory leak occurs when controller initialization fails after admin queue setup but before completion, which is an error handling path. The issue was found during automated testing with blktests. While repeated controller initialization failures could consume kernel memory, this does not lead to crashes or code execution.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 3.3 | 5.5 | N/A |
| Attack Vector | Local | Local | N/A |
| Attack Complexity | Low | Low | N/A |
| Privileges Required | Low | Low | N/A |
| User Interaction | None | None | N/A |
| Scope | Unchanged | Unchanged | N/A |
| Confidentiality | None | None | N/A |
| Integrity Impact | None | None | N/A |
| Availability Impact | Low | High | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L
NVD: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
