Executive brief
A memory leak vulnerability was identified in the Linux kernel's NVMe over Fibre Channel (NVMe/FC) driver. When the system fails to initialize a new storage controller, it may fail to release certain internal memory resources. Over time, repeated initialization failures could exhaust system memory, potentially leading to a denial-of-service condition where the system becomes unstable or crashes.
Technical details
A memory leak (CWE-401) exists in drivers/nvme/host/fc.c within the nvme_fc_init_ctrl() function. The vulnerability is triggered when nvme_fc_init_ctrl() successfully allocates admin blk-mq resources but subsequently encounters a failure in later initialization steps (such as changing controller state or scheduling connect work). In these failure scenarios, the code jumps to the 'fail_ctrl' label which tears down controller references but fails to call nvme_remove_admin_tag_set(), leaving the admin queue and tag set allocations in memory. An attacker with local access could potentially trigger this leak repeatedly to exhaust kernel memory. Patches have been released for multiple stable kernel branches to ensure nvme_remove_admin_tag_set() is called during the failure path.
Affected products
- Linux Linux Kernel 6.6.118 to 6.6.124, 6.12.60 to 6.12.70, 6.17.10 to 6.18, 6.18.1 to 6.18.10, 6.19-rc1 to 6.19-rc8
Timeline
- 2025-12-19: other: Patch authored
- 2026-03-18: disclosed: CVE published
- 2026-05-22: advisory: NVD analysis updated