Linux EUVD-2026-15339

The vulnerability exists in the NVMe (Non-Volatile Memory Express) subsystem of the Linux kernel, specifically in the admin tag set allocation logic during controller reset sequences. The affected code is referenced in the Linux kernel codebase (CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*), where the nvme_alloc_admin_tag_set() function was introduced as part of commit 03b3bcd319b3 intended to fix admin request_queue lifetime management. However, this change introduced a regression: when a controller reset occurs and nvme_alloc_admin_tag_set() is called, any previously existing admin queue is not properly deallocated before the new one is allocated. This is a resource management issue analogous to CWE-401 (Missing Release of Memory after Effective Lifetime) or CWE-772 (Missing Release of Resource after Effective Lifetime), where system memory and queue structures persist beyond their intended scope, degrading system stability over time.