Executive brief
This is a memory leak in the Linux kernel's NVMe PCI driver. When an NVMe device fails to probe after certain initialization steps, allocated DMA memory pools are not released, causing memory to be wasted. While this does not directly compromise system security or data, it can gradually degrade system stability and performance on servers with many NVMe devices or frequent probe failures.
Technical details
The vulnerability is a resource leak in the nvme-pci driver (drivers/nvme/host/pci.c). Per-NUMA-node descriptor DMA pools are created lazily during controller initialization once the admin tag set is allocated, but they are only properly destroyed in the normal teardown path via nvme_remove(). When a probe failure occurs after tag set allocation, the error path unwinds through the out_disable label and nvme_pci_free_ctrl(), neither of which invokes nvme_release_descriptor_pools(). This leaves dma_pool objects allocated in kernel memory. The fix adds an explicit call to nvme_release_descriptor_pools() in the out_disable error path, carefully avoiding placement in nvme_pci_free_ctrl() to prevent double-free on normal shutdown. No authentication or network access is required; this affects any Linux system running NVMe hardware with probe failures.
Affected products
- Linux Linux kernel Linux 5.0 and later (specific versions unknown; patched upstream)
Timeline
- 2026-09-17: disclosed
- 2026-09-14: patched: Patch committed upstream and in stable kernel trees