CVE-2026-90233 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
nvme-pci: release descriptor pools on probe failure
The per-NUMA-node descriptor DMA pools are created lazily from nvme_init_hctx_common() once the admin tag set is allocated, but they are only destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any probe failure after the admin tag set has been allocated unwinds through the out_disable label and nvme_pci_free_ctrl(), neither of which releases the pools, leaking the dma_pool objects.
Release the descriptor pools in the out_disable error path. It must not be added to nvme_pci_free_ctrl(), as that would double-free against nvme_remove() on the normal teardown path.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel's NVMe PCI driver contains a resource management flaw related to the lifecycle of DMA descriptor pools, specifically within the device initialization and error handling paths. The vulnerability arises from an asymmetry in how these memory resources are allocated versus when they are deallocated during the probe process. During normal operation, per-NUMA-node descriptor DMA pools are created lazily via the nvme_init_hctx_common function once the admin tag set has been successfully allocated. This lazy initialization is a performance optimization intended to defer resource consumption until hardware context sets are actually required for I/O operations. However, the current implementation only ensures these pools are destroyed during the standard device removal sequence through the nvme_remove function, which calls nvme_release_descriptor_pools.
The critical technical flaw occurs when the probe operation fails after the admin tag set has been allocated but before or without reaching the point where descriptor pools would be cleaned up in a normal teardown scenario. In such failure cases, the error handling logic unwinds through the out_disable label and invokes nvme_pci_free_ctrl to clean up partially initialized state. Unfortunately, neither of these functions includes logic to release the previously allocated DMA pool objects. Consequently, any probe failure that occurs after this specific point results in a memory leak where the dma_pool structures remain allocated but become unreachable as the device structure is freed or marked for removal. This represents a classic resource management error where cleanup paths are incomplete relative to allocation points.
From an industry standard perspective, this vulnerability aligns with CWE-401, which describes missing release of memory after effective lifetime, and more specifically CWE-772, regarding the lack of releasing resources after acquiring them. The operational impact is primarily characterized by gradual system resource exhaustion over time if probe failures are frequent or recurring in a given environment. While a single instance might seem negligible, repeated occurrences can lead to increased kernel memory consumption, potentially contributing to out-of-memory conditions under heavy load or during extensive device hot-plug operations. Although this does not directly allow for arbitrary code execution or privilege escalation, the accumulation of leaked kernel memory degrades system stability and performance, violating principles of robust resource management expected in critical infrastructure components like storage drivers.
The mitigation strategy implemented involves modifying the error handling path to explicitly release the descriptor pools when a probe failure is detected after their potential creation. The fix carefully places this cleanup logic within the out_disable label's execution flow rather than in nvme_pci_free_ctrl. This distinction is crucial because adding the release call to nvme_pci_free_ctrl would result in double-free vulnerabilities during normal device teardown, as nvme_remove also calls that function and subsequently releases the pools. By targeting only the error path where the standard cleanup sequence has not yet occurred or been completed, the patch ensures deterministic resource deallocation without introducing new concurrency or state management bugs. This approach maintains the integrity of the driver's lifecycle while correcting the oversight in failure scenarios.
Security practitioners should monitor for updates to the Linux kernel that include this specific fix for nvme-pci descriptor pool handling. System administrators managing environments with frequent NVMe device insertion and removal, particularly those involving hardware faults or incompatible devices triggering probe failures, are advised to apply relevant kernel patches promptly. Regular auditing of system memory usage can help detect anomalies indicative of such leaks in older systems where the patch has not yet been deployed. Adhering to secure coding practices that mandate symmetric allocation and deallocation logic across all execution paths is essential for preventing similar issues in other subsystems within the operating system core.