The Linux kernel did not deallocate the admin tagset for NVMe/FC controllers when initialization failed. This memory leak accumulates allocated blocks for the admin queue, reducing available kernel memory over time. Persistent failures could exhaust the kernel’s memory budget and cause out‑of‑memory conditions or kernel panics, impacting system availability.

This flaw resides in the nvme_fabrics path of the Linux kernel, so any kernel that includes the nvme-fc subsystem is potentially affected. No specific kernel version is listed, meaning all releases with this code path should be examined for the contained patch.

Risk and exploitability are moderate with a CVSS score of 5.5 and an EPSS less than 1%. The vulnerability is not in the CISA KEV catalog. The likely attack vector is exploiting the NVMe/FC controller initialization routine; based on the description it is inferred that an attacker could trigger the failure by sending malformed NVMe/FC requests or by repeatedly creating and destroying controllers with elevated privileges. Repeated failures would lead to cumulative memory leaks, potentially exhausting kernel memory over time.