CVE-2026-23360 Overview
A memory leak vulnerability has been identified in the Linux kernel's NVMe (Non-Volatile Memory Express) subsystem. The flaw occurs during controller reset operations when nvme_alloc_admin_tag_set() is called while a previous admin queue still exists. The failure to properly release the existing admin queue before allocating a new one results in orphaned memory resources.
This vulnerability was introduced as a regression by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"), which inadvertently created a code path where admin queues could be leaked during controller reset sequences.
Critical Impact
Systems with NVMe storage devices may experience memory exhaustion over time due to leaked admin queues during repeated controller reset operations, potentially leading to system instability or denial of service conditions.
Affected Products
- Linux kernel (NVMe subsystem)
- Systems utilizing NVMe storage devices with kernel drivers
Discovery Timeline
- 2026-03-25 - CVE-2026-23360 published to NVD
- 2026-03-25 - Last updated in NVD database
Technical Details for CVE-2026-23360
Vulnerability Analysis
The vulnerability exists within the NVMe driver's controller reset handling code path. When an NVMe controller undergoes a reset operation, the kernel must deallocate existing resources and reinitialize the controller's admin queue. The admin queue is a critical component used for management commands between the host and the NVMe controller.
The flaw manifests when nvme_alloc_admin_tag_set() is invoked during a controller reset scenario. Under normal circumstances, the function should verify whether an existing admin queue is present and release it before proceeding with the allocation of a new queue structure. However, due to the regression introduced by a previous patch, this cleanup step was inadvertently bypassed.
The practical impact is that each controller reset operation leaves behind an orphaned admin queue in kernel memory. Over time, particularly on systems experiencing frequent controller resets (such as those with hot-plug events, power management transitions, or error recovery scenarios), this memory leak can accumulate and lead to significant resource exhaustion.
Root Cause
The root cause is a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). While this commit aimed to address lifetime management issues with the admin request queue, it inadvertently removed or bypassed the cleanup logic that released existing admin queues during controller reset operations.
The missing cleanup step means that when nvme_alloc_admin_tag_set() allocates a new admin tag set, any previously existing admin queue structure remains allocated but unreferenced, creating a classic memory leak pattern.
Attack Vector
This vulnerability is primarily exploitable as a local denial of service attack vector. An attacker with local access to a system could potentially trigger repeated NVMe controller resets to accelerate memory exhaustion. The attack scenario involves:
- Gaining local access to a system with NVMe storage devices
- Triggering controller reset operations through various mechanisms (e.g., manipulating sysfs interfaces, causing error conditions)
- Repeating the reset operations to accumulate leaked memory
- Eventually exhausting available kernel memory, leading to system instability or crash
The vulnerability is classified with an unknown attack vector in formal scoring, but the practical exploitation requires local system access and the ability to trigger controller reset events.
Detection Methods for CVE-2026-23360
Indicators of Compromise
- Gradual increase in kernel memory usage (specifically in slab allocations) over time
- Memory pressure warnings or OOM (Out of Memory) killer activations on systems with NVMe storage
- Unusual frequency of NVMe controller reset events in kernel logs
- Presence of orphaned NVMe admin queue structures in kernel memory dumps
Detection Strategies
- Monitor kernel memory allocation patterns using tools like /proc/slabinfo or slabtop for NVMe-related allocations
- Configure alerting on NVMe controller reset events via kernel log monitoring (dmesg patterns)
- Track system memory trends over extended periods, particularly on servers with active NVMe storage
- Implement kernel memory leak detection tools such as kmemleak to identify unreferenced memory blocks
Monitoring Recommendations
- Enable NVMe driver debug logging to capture controller reset events and their frequency
- Set up memory utilization baselines and alert thresholds for systems running vulnerable kernel versions
- Use SentinelOne's kernel-level monitoring capabilities to detect anomalous memory consumption patterns
- Review system logs for patterns indicating repeated controller reset cycles
How to Mitigate CVE-2026-23360
Immediate Actions Required
- Apply the kernel patches as soon as they become available from your Linux distribution
- Monitor affected systems for memory leak symptoms and schedule proactive reboots if necessary
- Reduce the frequency of NVMe controller reset operations where operationally feasible
- Consider temporarily disabling hot-plug functionality for NVMe devices if excessive resets are occurring
Patch Information
The Linux kernel development team has released patches to address this memory leak vulnerability. Multiple patch commits have been made available for different kernel stable branches:
- Kernel Patch Commit 64f87b96
- Kernel Patch Commit 8eb2b3cd
- Kernel Patch Commit b84bb7bd
- Kernel Patch Commit e159eb85
The fix ensures that any existing admin queue is properly released before a new one is allocated during controller reset operations.
Workarounds
- Limit NVMe controller reset operations by avoiding unnecessary hot-plug events or power management transitions
- Implement scheduled system reboots to periodically reclaim leaked memory on systems that cannot be immediately patched
- Monitor and alert on memory consumption to proactively address resource exhaustion before system stability is impacted
- Consider temporarily reverting commit 03b3bcd319b3 if running a custom kernel build, though this may reintroduce the original issue it was intended to fix
# Check current kernel version and NVMe driver status
uname -r
lsmod | grep nvme
# Monitor NVMe-related kernel memory allocations
cat /proc/slabinfo | grep -i nvme
# Review kernel logs for NVMe controller reset events
dmesg | grep -i "nvme.*reset"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
