CVE-2026-90233
Description
In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvme_init_hctx_common() once the admin tag set is allocated, but they are only destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any probe failure after the admin tag set has been allocated unwinds through the out_disable label and nvme_pci_free_ctrl(), neither of which releases the pools, leaking the dma_pool objects. Release the descriptor pools in the out_disable error path. It must not be added to nvme_pci_free_ctrl(), as that would double-free against nvme_remove() on the normal teardown path.
How to fix
- Linux Linuxc25b6b28a35f9e36ce5dd6da5905bcddb2128707, 79fb405966edb5065234440d94cc75bfd7b01f41, cb144c2f67128abfa5c7ba33318617d19f192156 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | d977506f8863807129d7a11f4057dfb1b38085ea ≤ v < c25b6b28a35f9e36ce5dd6da5905bcddb2128707, d977506f8863807129d7a11f4057dfb1b38085ea ≤ v < 79fb405966edb5065234440d94cc75bfd7b01f41, d977506f8863807129d7a11f4057dfb1b38085ea ≤ v < cb144c2f67128abfa5c7ba33318617d19f192156, 6.16 | c25b6b28a35f9e36ce5dd6da5905bcddb2128707, 79fb405966edb5065234440d94cc75bfd7b01f41, cb144c2f67128abfa5c7ba33318617d19f192156 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.