{"id":"CVE-2026-90233","revision":"43641d56841d4712aab1e02b1ab2c4d0","records":[{"revision":"43641d56841d4712aab1e02b1ab2c4d0","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-90233","aliases":[],"title":"nvme-pci: release descriptor pools on probe failure","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme-pci: release descriptor pools on probe failure\n\nThe per-NUMA-node descriptor DMA pools are created lazily from\nnvme_init_hctx_common() once the admin tag set is allocated, but they are\nonly destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any\nprobe failure after the admin tag set has been allocated unwinds through\nthe out_disable label and nvme_pci_free_ctrl(), neither of which releases\nthe pools, leaking the dma_pool objects.\n\nRelease the descriptor pools in the out_disable error path. It must not\nbe added to nvme_pci_free_ctrl(), as that would double-free against\nnvme_remove() on the normal teardown path.","state":0,"publishedAt":"2026-09-17T16:07:39.941+00:00","modifiedAt":"2026-10-19T09:00:09.595+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"d977506f8863807129d7a11f4057dfb1b38085ea\",\n                            \"lessThan\": \"c25b6b28a35f9e36ce5dd6da5905bcddb2128707\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d977506f8863807129d7a11f4057dfb1b38085ea\",\n                            \"lessThan\": \"79fb405966edb5065234440d94cc75bfd7b01f41\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"d977506f8863807129d7a11f4057dfb1b38085ea\",\n                            \"lessThan\": \"cb144c2f67128abfa5c7ba33318617d19f192156\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/nvme/host/pci.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.16\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.16\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.52\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.2.6\",\n                            \"lessThanOrEqual\": \"7.2.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.3\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[],"references":["https://git.kernel.org/stable/c/c25b6b28a35f9e36ce5dd6da5905bcddb2128707","https://git.kernel.org/stable/c/79fb405966edb5065234440d94cc75bfd7b01f41","https://git.kernel.org/stable/c/cb144c2f67128abfa5c7ba33318617d19f192156"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-90233","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-90233","identifiers":["CVE-2026-90233"]},"retained":false,"historicalAffected":[]}],"coverage":[]}