CVE-2026-23261: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23261 is a memory leak vulnerability in the Linux kernel's NVMe/FC (NVMe over Fibre Channel) subsystem, specifically in the nvme_fc_init_ctrl() controller initialization path. When controller setup fails after admin block-mq queue resources have been allocated, the error handling path (fail_ctrl) tears down controller references but never frees the admin queue and tag set, resulting in unrecoverable kernel memory leaks. The vulnerability affects Linux kernel versions across multiple stable branches, with fixes backported to 6.1.163, 6.6.124, 6.12.70, 6.18.10, and 6.19. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Feedly).

The root cause is classified as CWE-401 (Missing Release of Memory after Effective Lifetime). In the NVMe/FC controller creation path — nvmf_dev_write() → nvmf_create_ctrl() → nvme_fc_create_ctrl() → nvme_fc_init_ctrl() — admin blk-mq resources are allocated immediately after nvme_add_ctrl() succeeds. If any subsequent step fails (e.g., changing controller state or scheduling connect work), execution jumps to the fail_ctrl label, which does not check ctrl->ctrl.admin_tagset and therefore never calls nvme_remove_admin_tag_set(). The fix adds this check so that admin queue allocations are properly reclaimed on any initialization abort. The leaked allocations were confirmed via kmemleak reports during blktests nvme/fc testing (Red Hat Advisory).

Successful exploitation results in a Denial of Service (DoS) condition affecting system availability. A local user with privileges to create NVMe/FC controllers can trigger repeated controller initialization failures, causing progressive kernel memory exhaustion that may render the system unresponsive or cause a crash. There is no impact on confidentiality or data integrity, and the scope is limited to the affected host with no lateral movement potential (Feedly).

Update the Linux kernel to a patched stable version: 6.1.163, 6.6.124, 6.12.70, 6.18.10, or 6.19 (and later). SUSE has released security updates (SUSE-SU-2026:2217-1 and SUSE-SU-2026:2238-1) addressing this vulnerability. As a workaround, restrict local access to NVMe/FC device creation to trusted users only, reducing the risk of deliberate exploitation. Organizations running affected kernel versions in NVMe/FC storage environments should prioritize patching (Red Hat Advisory, SUSE Advisory).