CVE-2026-23360

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-23360
In the Linux kernel, the following vulnerability has been resolved: nvme: fix admin queue leak on controller reset When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue. This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eade Patch
https://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 Patch
https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6 Patch
https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356 Patch
https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f Patch
https://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d Patch
https://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.1.167:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
History

24 Apr 2026, 18:59

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.5
CWE CWE-401
First Time Linux
Linux linux Kernel
CPE cpe:2.3:o:linux:linux_kernel:6.1.167:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eade - () https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eade - Patch
References () https://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 - () https://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 - Patch
References () https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6 - () https://git.kernel.org/stable/c/64f87b96de0e645a4c066c7cffd753f334446db6 - Patch
References () https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356 - () https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356 - Patch
References () https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f - () https://git.kernel.org/stable/c/8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f - Patch
References () https://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d - () https://git.kernel.org/stable/c/b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d - Patch
References () https://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913 - () https://git.kernel.org/stable/c/e159eb852aeee95443a9458ecb7d072bbb689913 - Patch

11 Apr 2026, 13:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/089a6f17881a82c6c6e05f8564a867be0767eade -
  • () https://git.kernel.org/stable/c/6e28bab900e40e4d610b04f9f82e01983d8fb356 -

02 Apr 2026, 12:16

Type Values Removed Values Added
References
  • () https://git.kernel.org/stable/c/2efbc838a26d3da72d8fe05770bdf869d4ca3ac5 -
Summary
  • (es) En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: nvme: corrige la fuga de la cola de administración al reiniciar el controlador Cuando se llama a nvme_alloc_admin_tag_set() durante un reinicio del controlador, una cola de administración anterior aún puede existir. Libérela correctamente antes de asignar una nueva para evitar dejar huérfana la cola antigua. Esto corrige una regresión introducida por el commit 03b3bcd319b3 ('nvme: corrige la vida útil de request_queue de administración').

25 Mar 2026, 11:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-03-25 11:16

Updated : 2026-04-24 18:59

NVD link : CVE-2026-23360

Mitre link : CVE-2026-23360

CVE.ORG link : CVE-2026-23360

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-401

Missing Release of Memory after Effective Lifetime