CVE-2026-23360 Overview
CVE-2026-23360 is a memory leak vulnerability in the Linux kernel's NVMe subsystem [CWE-401]. The flaw exists in the nvme_alloc_admin_tag_set() function, which fails to release a previously allocated admin queue when invoked during a controller reset. The result is an orphaned admin queue that leaks kernel memory each time a reset occurs.
The issue is a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). A local attacker with the ability to trigger NVMe controller resets can exhaust kernel memory and cause a denial-of-service condition on the host.
Critical Impact
Repeated NVMe controller resets leak admin queues, exhausting kernel memory and degrading availability of storage-dependent Linux systems.
Affected Products
- Linux kernel 6.1.167
- Linux kernel 6.18
- Linux kernel 7.0-rc1 and 7.0-rc2
Discovery Timeline
- 2026-03-25 - CVE-2026-23360 published to NVD
- 2026-04-24 - Last updated in NVD database
Technical Details for CVE-2026-23360
Vulnerability Analysis
The vulnerability resides in the NVMe driver path that allocates the admin tag set during controller initialization and reset. When nvme_alloc_admin_tag_set() runs during a controller reset, an admin request_queue from the prior controller lifecycle may still be allocated. The function proceeds to allocate a new admin queue without releasing the previous one, resulting in an orphaned request_queue structure that is no longer referenced by any controller state.
Each orphaned queue retains kernel memory for the queue itself, its associated tag set metadata, and any embedded structures the block layer attaches to a request_queue. Repeated resets compound the leak. On systems where controller resets occur frequently due to faulty hardware, firmware errors, or attacker-triggered conditions, the cumulative memory loss can degrade system stability.
The fix restores the queue lifecycle invariant by releasing the existing admin queue before allocating a replacement during reset. This corrects the regression introduced by commit 03b3bcd319b3, which altered the request queue lifetime handling.
Root Cause
The root cause is missing cleanup logic in nvme_alloc_admin_tag_set() when called on the reset path. The function assumes a clean state but does not validate or release an existing admin request_queue before allocating a new tag set. This violates resource ownership rules in the kernel block layer and produces the missing-release pattern tracked by [CWE-401].
Attack Vector
Exploitation requires local access with privileges sufficient to trigger NVMe controller resets, either through administrative nvme reset commands, error injection, or hardware-induced reset events. The vulnerability does not enable code execution or data disclosure. Impact is limited to availability: sustained memory leaks can lead to out-of-memory conditions on long-running systems with frequent controller resets.
The vulnerability mechanism is described in prose only — see the upstream commits in the Linux kernel stable tree for the precise fix.
Detection Methods for CVE-2026-23360
Indicators of Compromise
- Steadily growing kernel slab usage in /proc/slabinfo for request_queue and related block layer caches without a corresponding workload increase.
- Repeated nvme nvmeX: resetting controller messages in dmesg correlated with rising kernel memory consumption.
- Unexplained drop in MemAvailable reported by /proc/meminfo on hosts with NVMe storage.
Detection Strategies
- Track running kernel version against the fixed stable releases listed in the upstream commits and flag hosts still running affected versions.
- Monitor for frequent NVMe controller reset events through kernel log forwarding to a centralized log platform.
- Correlate NVMe reset rates with kernel slab growth using node-level telemetry to identify hosts exhibiting the leak pattern.
Monitoring Recommendations
- Forward kern.log and dmesg output to a SIEM and alert on repeated nvme.*resetting controller occurrences within short time windows.
- Capture per-host slab allocator metrics (slabtop, node_exporter slab collectors) to baseline normal request_queue cache size.
- Alert on Linux hosts whose kernel version matches the affected ranges identified in the NVD CPE list.
How to Mitigate CVE-2026-23360
Immediate Actions Required
- Inventory all Linux hosts running kernel 6.1.167, 6.18, or 7.0-rc1/rc2 and prioritize patching servers with NVMe storage.
- Apply the stable kernel update containing the upstream fix and reboot affected systems.
- Restrict the ability to issue nvme reset commands to trusted administrators by enforcing least privilege on the CAP_SYS_ADMIN capability.
Patch Information
The fix has been merged into the Linux stable tree across multiple branches. Refer to the upstream commits: 089a6f1, 2efbc83, 64f87b9, 6e28bab, 8eb2b3c, b84bb7b, and e159eb8. Update to the corresponding distribution-provided kernel as soon as it becomes available.
Workarounds
- Reduce the frequency of NVMe controller resets by investigating and remediating underlying hardware or firmware faults that trigger them.
- Schedule periodic reboots on affected hosts to reclaim leaked kernel memory until the patched kernel is deployed.
- Limit local shell and administrative access on storage-critical hosts to reduce the population of users able to induce resets.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
