CVE-2026-23360

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix admin queue leak on controller reset

When nvme_alloc_admin_tag_set() is called during a controller reset, a previous admin queue may still exist. Release it properly before allocating a new one to avoid orphaning the old queue.

This fixes a regression introduced by commit 03b3bcd319b3 ("nvme: fix admin request_queue lifetime").

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-401

Affected software

VendorProductVersions
LinuxLinux>= ff037b5f47eeccc1636c03f84cd47db094eb73c9, < 089a6f17881a82c6c6e05f8564a867be0767eade; >= 4896491c497226022626c3acc46044fd182f943c, < 6e28bab900e40e4d610b04f9f82e01983d8fb356; >= a505f0ba36ab24176c300d7ff56aff85c2977e6c, < 2efbc838a26d3da72d8fe05770bdf869d4ca3ac5; >= e8061d02b49c5c901980f58d91e96580e9a14acf, < 64f87b96de0e645a4c066c7cffd753f334446db6; >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0, < e159eb852aeee95443a9458ecb7d072bbb689913; >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0, < 8eb2b3cdcd9b6631b94b82c1f4f6bc32b40d942f; >= 03b3bcd319b3ab5182bc9aaa0421351572c78ac0, < b84bb7bd913d8ca2f976ee6faf4a174f91c02b8d; e7dac681790556c131854b97551337aa8042215b; >= 6.1.167, < 6.1.168; >= 6.6.120, < 6.6.131; >= 6.12.62, < 6.12.77; >= 6.17.12, < 6.18
LinuxLinux6.18

References

Timeline

Published
Mar 25, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-233617.8In the Linux kernel, the following vulnerability has been resolved: PCI: dwc: ep: Flush MSI-X write before unmapping its ATU entry EndpoinCVE-2026-233625.5In the Linux kernel, the following vulnerability has been resolved: can: bcm: fix locking for bcm_op runtime updates Commit c2aba69d0c36 (CVE-2026-233637.1In the Linux kernel, the following vulnerability has been resolved: wifi: mt76: mt7925: Fix possible oob access in mt7925_mac_write_txwi_80CVE-2026-233647.4In the Linux kernel, the following vulnerability has been resolved: ksmbd: Compare MACs in constant time To prevent timing attacks, MAC coCVE-2026-233655.5In the Linux kernel, the following vulnerability has been resolved: net: usb: kalmia: validate USB endpoints The kalmia driver should valiCVE-2026-233665.5In the Linux kernel, the following vulnerability has been resolved: drm/client: Do not destroy NULL modes 'modes' in drm_client_modeset_prCVE-2026-233675.5In the Linux kernel, the following vulnerability has been resolved: wifi: radiotap: reject radiotap with unknown bits The radiotap parser CVE-2026-233685.5In the Linux kernel, the following vulnerability has been resolved: net: phy: register phy led_triggers during probe to avoid AB-BA deadlocCVE-2026-233695.5In the Linux kernel, the following vulnerability has been resolved: i2c: i801: Revert "i2c: i801: replace acpi_lock with I2C bus lock" ThiCVE-2026-23378.7A vulnerability in Plunet Plunet BusinessManager allows session hijacking, data theft, unauthorized actions on behalf of the user.This issueCVE-2026-233705.5In the Linux kernel, the following vulnerability has been resolved: platform/x86: dell-wmi-sysman: Don't hex dump plaintext password data CVE-2026-233715.5In the Linux kernel, the following vulnerability has been resolved: sched/deadline: Fix missing ENQUEUE_REPLENISH during PI de-boosting Ru
CVE-2026-23360: Medium severity, CVSS 5.5 | Vulnix