CVE-2026-23360

nvme: fix admin queue leak on controller reset

State: Published
Severity: Not scored
Published: Mar 25, 2026
Updated: May 23, 2026
Reserved: Jan 13, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix admin queue leak on controller reset

When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue.

This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	ff037b5f47eeccc1636c03f84cd47db094eb73c9 to before 089a6f17881a82c6c6e05f8564a867be0767eadeAffected 4896491c497226022626c3acc46044fd182f943c to before 6e28bab900e40e4d610b04f9f82e01983d8fb356Affected a505f0ba36ab24176c300d7ff56aff85c2977e6c to before 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5Affected e8061d02b49c5c901980f58d91e96580e9a14acf to before 64f87b96de0e645a4c066c7cffd753f334446db6Affected 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before e159eb852aeee95443a9458ecb7d072bbb689913Affected 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942fAffected 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before b84bb7bd913d8ca2f976ee6faf4a174f91c02b8dAffected e7dac681790556c131854b97551337aa8042215bAffected 6.1.167 to before 6.1.168Affected 6.6.120 to before 6.6.131Affected 6.12.62 to before 6.12.77Affected 6.17.12 to before 6.18Affected
LinuxLinux	6.18Affected before 6.18Not affected 6.1.168 through 6.1.Not affected 6.6.131 through 6.6.Not affected 6.12.77 through 6.12.Not affected 6.18.17 through 6.18.Not affected 6.19.7 through 6.19.*Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

ff037b5f47eeccc1636c03f84cd47db094eb73c9 to before 089a6f17881a82c6c6e05f8564a867be0767eadeAffected
4896491c497226022626c3acc46044fd182f943c to before 6e28bab900e40e4d610b04f9f82e01983d8fb356Affected
a505f0ba36ab24176c300d7ff56aff85c2977e6c to before 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5Affected
e8061d02b49c5c901980f58d91e96580e9a14acf to before 64f87b96de0e645a4c066c7cffd753f334446db6Affected
03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before e159eb852aeee95443a9458ecb7d072bbb689913Affected
03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942fAffected
03b3bcd319b3ab5182bc9aaa0421351572c78ac0 to before b84bb7bd913d8ca2f976ee6faf4a174f91c02b8dAffected
e7dac681790556c131854b97551337aa8042215bAffected
6.1.167 to before 6.1.168Affected
6.6.120 to before 6.6.131Affected
6.12.62 to before 6.12.77Affected
6.17.12 to before 6.18Affected

LinuxLinux

6.18Affected
before 6.18Not affected
6.1.168 through 6.1.*Not affected
6.6.131 through 6.6.*Not affected
6.12.77 through 6.12.*Not affected
6.18.17 through 6.18.*Not affected
6.19.7 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.