---
id: CVE-2026-90233
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-pci: release descriptor pools on probe failure

  The per-NUMA-node descriptor DMA pools are created lazily from
  nvme_init_hctx_common() once the admin tag set is al…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  nvme-pci: release descriptor pools on probe failure

  The per-NUMA-node descriptor DMA pools are created lazily from
  nvme_init_hctx_common() once the admin tag set is al…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= d977506f8863807129d7a11f4057dfb1b38085ea <
    c25b6b28a35f9e36ce5dd6da5905bcddb2128707
  - >-
    Linux >= d977506f8863807129d7a11f4057dfb1b38085ea <
    79fb405966edb5065234440d94cc75bfd7b01f41
  - >-
    Linux >= d977506f8863807129d7a11f4057dfb1b38085ea <
    cb144c2f67128abfa5c7ba33318617d19f192156
  - Linux 6.16
published: '2026-09-17'
updated: '2026-09-17'
sourceUpdated: '2026-09-17T17:17:19.173'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-90233'
references:
  - url: 'https://git.kernel.org/stable/c/79fb405966edb5065234440d94cc75bfd7b01f41'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/c25b6b28a35f9e36ce5dd6da5905bcddb2128707'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/cb144c2f67128abfa5c7ba33318617d19f192156'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-17T16:21:47.851Z'
epss: 0.00198
epssPercentile: 0.09839
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

nvme-pci: release descriptor pools on probe failure

The per-NUMA-node descriptor DMA pools are created lazily from
nvme_init_hctx_common() once the admin tag set is allocated, but they are
only destroyed in nvme_remove() via nvme_release_descriptor_pools(). Any
probe failure after the admin tag set has been allocated unwinds through
the out_disable label and nvme_pci_free_ctrl(), neither of which releases
the pools, leaking the dma_pool objects.

Release the descriptor pools in the out_disable error path. It must not
be added to nvme_pci_free_ctrl(), as that would double-free against
nvme_remove() on the normal teardown path.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.