CVE-2026-23360: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23360 is a memory leak vulnerability in the Linux kernel's NVMe subsystem, specifically in the admin queue management during controller reset operations. When nvme_alloc_admin_tag_set() is called during a controller reset, a previously existing admin queue is not properly released before a new one is allocated, resulting in orphaned queue objects. This is a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime"). Affected kernel versions include ranges from 6.6.120 through 6.19.x and 6.18, with patches available in 6.6.131+, 6.12.77+, 6.18.17+, 6.19.7+, and 7.0-rc3+. The vulnerability carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-772 (Missing Release of Resource after Effective Lifetime) and CWE-401 (Missing Release of Memory after Effective Lifetime). During an NVMe controller reset, the kernel calls nvme_alloc_admin_tag_set() without first checking whether a prior admin queue already exists and releasing it; the old queue object is orphaned in kernel memory. Exploitation requires local access with low privileges — an attacker or process capable of triggering repeated NVMe controller resets can cause cumulative kernel memory leakage. No public proof-of-concept exploit code has been identified (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation leads exclusively to availability impact — there is no confidentiality or integrity compromise. Repeated NVMe controller reset operations cause orphaned admin queue objects to accumulate in kernel memory, potentially exhausting kernel memory resources and resulting in denial of service, system performance degradation, or system instability. The vulnerability is limited to local exploitation and does not enable lateral movement or data exfiltration (Red Hat Advisory).

There is no evidence of public proof-of-concept exploit code or active in-the-wild exploitation of CVE-2026-23360. The EPSS score is approximately 0.018% (0.000180), indicating very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local access with low-level privileges, significantly limiting the attacker surface (Red Hat Advisory).

The Linux kernel maintainers have released patches addressing this vulnerability in the following versions: 6.6.131+, 6.12.77+, 6.18.17+, 6.19.7+, and 7.0-rc3+. Patch commits are available from kernel.org stable trees. As interim mitigations, administrators should restrict local user access and limit the ability of unprivileged users to trigger NVMe controller resets, and monitor kernel memory usage for unexpected increases that could indicate queue object leakage. Applying kernel updates as part of regular patching cycles is the recommended long-term solution (Red Hat Advisory, Red Hat Bugzilla).