Cloudanix VulnDB

CVE-2026-90233

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A storage driver bug can waste memory when certain hardware errors occur, which might eventually slow the system or cause crashes if the same error keeps happening.

Exploitation
Other
Attacker needs
Local User
Complexity
Theoretical
Impact
Denial Of Service
Component
OS kernel
Class
Denial of service
Remediation
Patch
Effort
Low
Patch risk
Low

What it actually does

Failure to release per-NUMA-node descriptor DMA pools on NVMe PCI probe failure after admin tag set allocation leaks dma_pool objects because the out_disable path and nvme_pci_free_ctrl() do not call the release function.

Why it matters to the business

Repeated NVMe device initialization failures can gradually exhaust kernel memory, leading to resource exhaustion, degraded I/O performance, or eventual denial of service on affected Linux systems.

How an attack unfolds

An attacker triggers NVMe PCI probe failures after the admin tag set has been allocated, for example by manipulating device state or hardware insertion/removal sequences, causing the kernel to leak descriptor pools on each failure without releasing them until a normal removal path occurs.

How to fix it

Apply the upstream kernel fix that adds descriptor pool release in the out_disable error path of nvme-pci; rebuild and deploy the patched kernel on affected systems.

How to confirm the fix worked

Inspect the nvme-pci driver source for the pool release call in the out_disable label and confirm via kernel build or runtime memory accounting that dma_pool objects are no longer leaked on probe failure.

Typical attack path

  1. Gain ability to induce NVMe PCI probe failures after admin tag set allocation
  2. Repeat probe failure sequences to accumulate leaked dma_pool objects
  3. Monitor for memory pressure or system instability as leaks grow

How to detect it

Review kernel logs for NVMe probe failure sequences without matching pool release messages, and use slabinfo or kmemleak tools to detect growing dma_pool allocations tied to nvme.

What your security team should do

  • Prioritize kernel updates containing the nvme-pci fix on all systems using NVMe devices
  • Enable kernel memory leak detection tooling to baseline DMA pool usage
  • Monitor EPSS and exploit maturity indicators for any future increase in this issue

The record

In the Linux kernel, the following vulnerability has been resolved: nvme-pci: release descriptor pools on probe failure The per-NUMA-node descriptor DMA pools are created lazily from nvme_init_hctx_common() once the admin tag set is allocated, but they are only destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any probe failure after the admin tag set has been allocated unwinds through the out_disable label and nvme_pci_free_ctrl(), neither of which releases the pools, leaking the dma_pool objects. Release the descriptor pools in the out_disable error path. It must not be added to nvme_pci_free_ctrl(), as that would double-free against nvme_remove() on the normal teardown path.

Affected packages

Ecosystem Package Introduced Fixed