An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - nvme-fc: release admin tagset if init fails nvme_fabrics creates an NVMe/FC controller in following path:
    nvmf_dev_write() -> nvmf_create_ctrl() -> nvme_fc_create_ctrl() -> nvme_fc_init_ctrl() nvme_fc_init_ctrl()     allocates the admin blk-mq resources right after nvme_add_ctrl() succeeds. If any of the subsequent steps     fail (changing the controller state, scheduling connect work, etc.), we jump to the fail_ctrl path, which     tears down the controller references but never frees the admin queue/tag set. The leaked blk-mq     allocations match the kmemleak report seen during blktests nvme/fc. Check ctrl->ctrl.admin_tagset in the     fail_ctrl path and call nvme_remove_admin_tag_set() when it is set so that all admin queue allocations are     reclaimed whenever controller setup aborts. (CVE-2026-23261)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Published	Updated	Severity
299743	Photon OS 5.0: Linux PHSA-2026-5.0-0770	Nessus	PhotonOS Local Security Checks	2/22/2026	4/5/2026	critical
302938	Linux Distros Unpatched Vulnerability : CVE-2026-23261	Nessus	Misc.	3/18/2026	3/20/2026	high

Detections

Analytics

Plugins Search

critical

high