CVE-2026-23261

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-23261", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-01-13T15:37:45.990Z", "datePublished": "2026-03-18T17:41:07.478Z", "dateUpdated": "2026-11-05T21:33:34.419Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:22.947Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n nvmf_dev_write()\n -> nvmf_create_ctrl()\n -> nvme_fc_create_ctrl()\n -> nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() allocates the admin blk-mq resources right after\nnvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing\nthe controller state, scheduling connect work, etc.), we jump to the\nfail_ctrl path, which tears down the controller references but never\nfrees the admin queue/tag set. The leaked blk-mq allocations match the\nkmemleak report seen during blktests nvme/fc.\n\nCheck ctrl->ctrl.admin_tagset in the fail_ctrl path and call\nnvme_remove_admin_tag_set() when it is set so that all admin queue\nallocations are reclaimed whenever controller setup aborts."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/fc.c"], "versions": [{"version": "5fe335a80548e2eda5d51fab801108b323600e95", "lessThan": "7c54d3f5ebbc5982daaa004260242dc07ac943ea", "status": "affected", "versionType": "git"}, {"version": "17c3a66d7ea2d303f783796d62f99e2e23b68c90", "lessThan": "fa301aef50e3f3b5be6ee53457608beae5aa7a01", "status": "affected", "versionType": "git"}, {"version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "lessThan": "e810b290922c535feb34bc90ab549446fe94d2a3", "status": "affected", "versionType": "git"}, {"version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "lessThan": "d1877cc7270302081a315a81a0ee8331f19f95c8", "status": "affected", "versionType": "git"}, {"version": "0d1840b2dd8fe073c020c39bf8e8e89488070801", "status": "affected", "versionType": "git"}, {"version": "6.6.118", "lessThan": "6.6.124", "status": "affected", "versionType": "semver"}, {"version": "6.12.60", "lessThan": "6.12.70", "status": "affected", "versionType": "semver"}, {"version": "6.17.10", "lessThan": "6.18", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/fc.c"], "versions": [{"version": "6.18", "status": "affected"}, {"version": "0", "lessThan": "6.18", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.124", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.70", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.10", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.118", "versionEndExcluding": "6.6.124"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.12.60", "versionEndExcluding": "6.12.70"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.18.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.18", "versionEndExcluding": "6.19"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.17.10"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea"}, {"url": "https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01"}, {"url": "https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3"}, {"url": "https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8"}], "title": "nvme-fc: release admin tagset if init fails", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:24:22.816379Z"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:33:34.419Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-23261", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-05T21:24:22.816379Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-05T21:24:24.199Z"}}], "cna": {"title": "nvme-fc: release admin tagset if init fails", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5fe335a80548e2eda5d51fab801108b323600e95", "lessThan": "7c54d3f5ebbc5982daaa004260242dc07ac943ea", "versionType": "git"}, {"status": "affected", "version": "17c3a66d7ea2d303f783796d62f99e2e23b68c90", "lessThan": "fa301aef50e3f3b5be6ee53457608beae5aa7a01", "versionType": "git"}, {"status": "affected", "version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "lessThan": "e810b290922c535feb34bc90ab549446fe94d2a3", "versionType": "git"}, {"status": "affected", "version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "lessThan": "d1877cc7270302081a315a81a0ee8331f19f95c8", "versionType": "git"}, {"status": "affected", "version": "0d1840b2dd8fe073c020c39bf8e8e89488070801", "versionType": "git"}, {"status": "affected", "version": "6.6.118", "lessThan": "6.6.124", "versionType": "semver"}, {"status": "affected", "version": "6.12.60", "lessThan": "6.12.70", "versionType": "semver"}, {"status": "affected", "version": "6.17.10", "lessThan": "6.18", "versionType": "semver"}], "programFiles": ["drivers/nvme/host/fc.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"status": "unaffected", "version": "0", "lessThan": "6.18", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.124", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.70", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.10", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/nvme/host/fc.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea"}, {"url": "https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01"}, {"url": "https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3"}, {"url": "https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n nvmf_dev_write()\n -> nvmf_create_ctrl()\n -> nvme_fc_create_ctrl()\n -> nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() allocates the admin blk-mq resources right after\nnvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing\nthe controller state, scheduling connect work, etc.), we jump to the\nfail_ctrl path, which tears down the controller references but never\nfrees the admin queue/tag set. The leaked blk-mq allocations match the\nkmemleak report seen during blktests nvme/fc.\n\nCheck ctrl->ctrl.admin_tagset in the fail_ctrl path and call\nnvme_remove_admin_tag_set() when it is set so that all admin queue\nallocations are reclaimed whenever controller setup aborts."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.124", "versionStartIncluding": "6.6.118"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.70", "versionStartIncluding": "6.12.60"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.10", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19", "versionStartIncluding": "6.18"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionStartIncluding": "6.17.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-05-23T16:04:22.947Z"}}}, "cveMetadata": {"cveId": "CVE-2026-23261", "state": "PUBLISHED", "dateUpdated": "2026-11-05T21:33:34.419Z", "dateReserved": "2026-01-13T15:37:45.990Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-03-18T17:41:07.478Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/fc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7c54d3f5ebbc5982daaa004260242dc07ac943ea", "status": "affected", "version": "5fe335a80548e2eda5d51fab801108b323600e95", "versionType": "git"}, {"lessThan": "fa301aef50e3f3b5be6ee53457608beae5aa7a01", "status": "affected", "version": "17c3a66d7ea2d303f783796d62f99e2e23b68c90", "versionType": "git"}, {"lessThan": "e810b290922c535feb34bc90ab549446fe94d2a3", "status": "affected", "version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "versionType": "git"}, {"lessThan": "d1877cc7270302081a315a81a0ee8331f19f95c8", "status": "affected", "version": "ea3442efabd0aa3930c5bab73c3901ef38ef6ac3", "versionType": "git"}, {"status": "affected", "version": "0d1840b2dd8fe073c020c39bf8e8e89488070801", "versionType": "git"}, {"lessThan": "6.6.124", "status": "affected", "version": "6.6.118", "versionType": "semver"}, {"lessThan": "6.12.70", "status": "affected", "version": "6.12.60", "versionType": "semver"}, {"lessThan": "6.18", "status": "affected", "version": "6.17.10", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/fc.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.18"}, {"lessThan": "6.18", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.124", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.70", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "6.19", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1D668FD4-32B2-4105-8C08-3C1B33A00A13", "versionEndExcluding": "6.6.124", "versionStartIncluding": "6.6.118", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "DE749901-19D4-4591-B0D4-EED3C4B72504", "versionEndExcluding": "6.12.70", "versionStartIncluding": "6.12.60", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "AC4D9A16-72F2-4CA3-A8F5-80DD12FD7626", "versionEndExcluding": "6.18", "versionStartIncluding": "6.17.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "F337A30A-7E98-4F11-9B36-CA6427410816", "versionEndExcluding": "6.18.10", "versionStartIncluding": "6.18.1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:*", "matchCriteriaId": "DCE57113-2223-4308-A0F2-5E6ECFBB3C23", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:*", "matchCriteriaId": "38C4D89F-9A13-4D29-8645-C9785C142C07", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc1:*:*:*:*:*:*", "matchCriteriaId": "17B67AA7-40D6-4AFA-8459-F200F3D7CFD1", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc2:*:*:*:*:*:*", "matchCriteriaId": "C47E4CC9-C826-4FA9-B014-7FE3D9B318B2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc3:*:*:*:*:*:*", "matchCriteriaId": "F71D92C0-C023-48BD-B3B6-70B638EEE298", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc4:*:*:*:*:*:*", "matchCriteriaId": "13580667-0A98-40CC-B29F-D12790B91BDB", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc5:*:*:*:*:*:*", "matchCriteriaId": "CAD1FED7-CF48-47BF-AC7D-7B6FA3C065FC", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc7:*:*:*:*:*:*", "matchCriteriaId": "F5DC0CA6-F0AF-4DDF-A882-3DADB9A886A7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:6.19:rc8:*:*:*:*:*:*", "matchCriteriaId": "EB5B7DFC-C36B-45D8-922C-877569FDDF43", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-fc: release admin tagset if init fails\n\nnvme_fabrics creates an NVMe/FC controller in following path:\n\n nvmf_dev_write()\n -> nvmf_create_ctrl()\n -> nvme_fc_create_ctrl()\n -> nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() allocates the admin blk-mq resources right after\nnvme_add_ctrl() succeeds. If any of the subsequent steps fail (changing\nthe controller state, scheduling connect work, etc.), we jump to the\nfail_ctrl path, which tears down the controller references but never\nfrees the admin queue/tag set. The leaked blk-mq allocations match the\nkmemleak report seen during blktests nvme/fc.\n\nCheck ctrl->ctrl.admin_tagset in the fail_ctrl path and call\nnvme_remove_admin_tag_set() when it is set so that all admin queue\nallocations are reclaimed whenever controller setup aborts."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnvme-fc: liberar el conjunto de etiquetas de administraci\u00f3n si la inicializaci\u00f3n falla\n\nnvme_fabrics crea un controlador NVMe/FC en la siguiente ruta:\n\n nvmf_dev_write()\n -> nvmf_create_ctrl()\n -> nvme_fc_create_ctrl()\n -> nvme_fc_init_ctrl()\n\nnvme_fc_init_ctrl() asigna los recursos blk-mq de administraci\u00f3n justo despu\u00e9s de que nvme_add_ctrl() tenga \u00e9xito. Si alguno de los pasos subsiguientes falla (cambiar el estado del controlador, programar el trabajo de conexi\u00f3n, etc.), saltamos a la ruta fail_ctrl, que desmantela las referencias del controlador pero nunca libera la cola/conjunto de etiquetas de administraci\u00f3n. Las asignaciones blk-mq filtradas coinciden con el informe kmemleak visto durante blktests nvme/fc.\n\nVerificar ctrl->ctrl.admin_tagset en la ruta fail_ctrl y llamar a nvme_remove_admin_tag_set() cuando est\u00e9 establecido para que todas las asignaciones de la cola de administraci\u00f3n sean recuperadas cada vez que la configuraci\u00f3n del controlador se aborte."}], "id": "CVE-2026-23261", "lastModified": "2026-11-05T22:18:10.313", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 5.5, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-23261", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-05T21:24:22.816379Z", "version": "2.0.3"}}]}, "published": "2026-03-18T18:16:24.623", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/7c54d3f5ebbc5982daaa004260242dc07ac943ea"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/d1877cc7270302081a315a81a0ee8331f19f95c8"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e810b290922c535feb34bc90ab549446fe94d2a3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fa301aef50e3f3b5be6ee53457608beae5aa7a01"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{"bugzilla": {"description": "kernel: nvme-fc: release admin tagset if init fails", "id": "2448686", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2448686"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "details": ["No description is available for this CVE."], "name": "CVE-2026-23261", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-03-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-23261\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-23261\nhttps://lore.kernel.org/linux-cve-announce/2026031819-CVE-2026-23261-f757@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,b134dead095bc5a58fa2b98b90ae93428cb4b328)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7c54d3f5ebbc5982daaa004260242dc07ac943ea)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,fa301aef50e3f3b5be6ee53457608beae5aa7a01)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,e810b290922c535feb34bc90ab549446fe94d2a3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,d1877cc7270302081a315a81a0ee8331f19f95c8)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.163,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.124,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.70,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.10,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "analysis": {"en": {"generated_at": "2026-03-27T22:37:18.819088+00:00", "value": {"mitigation_remediation": ["Apply the latest Linux kernel update that contains the CVE-2026-23261 fix", "If patching is not immediately possible, monitor kernel memory usage for abnormal growth or kernel panic events", "Limit the frequency of NVMe/FC controller creation and destruction until the operating system is patched"], "summary": {"action": "Patch", "impact": "Memory Leak"}, "threat_synthesis": {"affected_systems": "This flaw resides in the nvme_fabrics path of the Linux kernel, so any kernel that includes the nvme-fc subsystem is potentially affected. No specific kernel version is listed, meaning all releases with this code path should be examined for the contained patch.", "description_and_impact": "The Linux kernel did not deallocate the admin tagset for NVMe/FC controllers when initialization failed. This memory leak accumulates allocated blocks for the admin queue, reducing available kernel memory over time. Persistent failures could exhaust the kernel\u2019s memory budget and cause out\u2011of\u2011memory conditions or kernel panics, impacting system availability.", "risk_and_exploitability": "Risk and exploitability are moderate with a CVSS score of 5.5 and an EPSS less than 1%. The vulnerability is not in the CISA KEV catalog. The likely attack vector is exploiting the NVMe/FC controller initialization routine; based on the description it is inferred that an attacker could trigger the failure by sending malformed NVMe/FC requests or by repeatedly creating and destroying controllers with elevated privileges. Repeated failures would lead to cumulative memory leaks, potentially exhausting kernel memory over time."}}}}, "created": "2026-03-19T08:55:58.280630+00:00", "updated": "2026-03-29T20:28:59.579603+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-401"]}