CVE-2026-23360
published 2026-03-25CVE-2026-23360: In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called…
PriorityP418medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.12%
2.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.19.8-1 (forky) | linux 6.19.8-1 (forky) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 < e159eb852aeee95443a9458ecb7d072bbb689913 | e159eb852aeee95443a9458ecb7d072bbb689913 |
| linux | linux | >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 < 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f | 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f |
| linux | linux | >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0 < b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d | b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d |
| linux | linux | >= 4896491c497226022626c3acc46044fd182f943c < 6e28bab900e40e4d610b04f9f82e01983d8fb356 | 6e28bab900e40e4d610b04f9f82e01983d8fb356 |
| linux | linux | >= 6.1.167 < 6.1.168 | 6.1.168 |
| linux | linux | >= 6.12.62 < 6.12.77 | 6.12.77 |
| linux | linux | >= 6.17.12 < 6.18 | 6.18 |
| linux | linux | >= 6.6.120 < 6.6.131 | 6.6.131 |
| linux | linux | >= a505f0ba36ab24176c300d7ff56aff85c2977e6c < 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 | 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 |
| linux | linux | >= e8061d02b49c5c901980f58d91e96580e9a14acf < 64f87b96de0e645a4c066c7cffd753f334446db6 | 64f87b96de0e645a4c066c7cffd753f334446db6 |
| linux | linux | >= ff037b5f47eeccc1636c03f84cd47db094eb73c9 < 089a6f17881a82c6c6e05f8564a867be0767eade | 089a6f17881a82c6c6e05f8564a867be0767eade |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 6.19.8-1 | 6.19.8-1 |
| linux | linux_kernel | >= 0 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.12.62 < 6.12.77 | 6.12.77 |
| linux | linux_kernel | >= 6.13.0 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.17.12 < 6.18 | 6.18 |
| linux | linux_kernel | >= 6.18.0 < 6.19.7 | 6.19.7 |
| linux | linux_kernel | >= 6.18.1 < 6.18.17 | 6.18.17 |
| linux | linux_kernel | >= 6.19 < 6.19.7 | 6.19.7 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_redhat5.5LOW
vendor_ubuntu2.0LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (HWE) vulnerabilities
vendor_ubuntu·2026-07-28·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (HWE) vulnerabilities
Title: Linux kernel (HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Azure FIPS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure FIPS) vulnerabilities
Title: Linux kernel (Azure FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local
Ubuntu
Linux kernel (AWS) vulnerabilities
vendor_ubuntu·2026-07-24·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (AWS) vulnerabilities
Title: Linux kernel (AWS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local a
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-43129 [LOW] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A loca
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-23·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Ubuntu
Linux kernel (GCP FIPS) vulnerabilities
vendor_ubuntu·2026-07-21·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel (GCP FIPS) vulnerabilities
Title: Linux kernel (GCP FIPS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A lo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-07-20·CVSS 2.0
CVE-2026-46073 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some AMD processors did not properly clear data in
the floating point divider unit during speculative execution. A local
attacker could use this to expose sensitive information. (CVE-2025-54505)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
It was discovered that some AMD Zen 5 processors supporting RDSEED
instruction did not properly handle entropy, potentially resulting in the
consumption of insufficiently random values. A local attacke
Red Hat
kernel: nvme: fix admin queue leak on controller reset
vendor_redhat·2026-03-25·CVSS 5.5
CVE-2026-23360 [LOW] CWE-772 kernel: nvme: fix admin queue leak on controller reset
kernel: nvme: fix admin queue leak on controller reset
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) subsystem. When an NVMe controller is reset, a previously allocated administration queue may not be properly released before a new one is created. This can lead to the old queue becoming orphaned, potentially causing resource exhaustion or system instability ov
Debian
CVE-2026-23360: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a...
vendor_debian·2026
CVE-2026-23360 [LOW] CVE-2026-23360: linux - In the Linux kernel, the following vulnerability has been resolved: nvme: fix a...
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved (fixed in 6.19.8-1)
sid: resolved (fixed in 6.19.8-1)
trixie: open
GHSA
GHSA-mx2c-4m76-c7r4: In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() i
ghsa_unreviewed·2026-03-25
CVE-2026-23360 GHSA-mx2c-4m76-c7r4: In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() i
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
OSV
CVE-2026-23360: In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is
osv·2026-03-25
CVE-2026-23360 CVE-2026-23360: In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").
OSV
nvme: fix admin queue leak on controller reset
osv·2026-03-25
CVE-2026-23360 nvme: fix admin queue leak on controller reset
nvme: fix admin queue leak on controller reset
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eadehttps://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942fhttps://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8dhttps://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913
2026-03-25
Published