CVE-2026-23360 — Missing Release of Resource after Effective Lifetime in Linux
Severity
5.5MEDIUM
No vectorEPSS
0.0%
top 90.94%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedMar 25
Description
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() is called during a controller reset,
a previous admin queue may still exist. Release it properly before
allocating a new one to avoid orphaning the old queue.
This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix
admin request_queue lifetime").
Affected Packages4 packages
▶CVEListV5linux/linuxff037b5f47eeccc1636c03f84cd47db094eb73c9 — 089a6f17881a82c6c6e05f8564a867be0767eade+8
🔴Vulnerability Details
3GHSA▶
GHSA-mx2c-4m76-c7r4: In the Linux kernel, the following vulnerability has been resolved:
nvme: fix admin queue leak on controller reset
When nvme_alloc_admin_tag_set() i↗2026-03-25
OSV▶
CVE-2026-23360: In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is↗2026-03-25