Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: nvmet: pci-epf: put CQ ref on create_cq mapping failure… (CVE-2026-80821)

The Linux kernel's nvmet_pci_epf_create_cq() function calls nvmet_cq_create(), which acquires a reference on the controller and installs a completion queue. If PCI address-space mapping fails or returns an insufficient partial mapping, the error handling paths previously did not call nvmet_cq_put() to release the acquired reference. Since the corresponding release in nvmet_pci_epf_delete_cq() depends on a flag set only after successful mapping, references were leaked on failure. This vulnerability allows a remote PCI host issuing Create IO CQ commands with failing PRP1/pci_addr to leak completion queue and controller references repeatedly. The patch adds calls to release the CQ reference on these failure paths, properly pairing create and put operations.

The vulnerability causes resource leaks in the Linux kernel's nvmet PCI endpoint driver when handling certain IO completion queue creation failures. A remote PCI host can trigger repeated leaks of completion queue and controller references by sending malformed Create IO CQ commands. This could lead to resource exhaustion on the affected system over time. There is no indication of direct code execution or privilege escalation from this issue.

A fix has been implemented in the Linux kernel to release the CQ reference on mapping failure paths in nvmet_pci_epf_create_cq(). Users should update to a kernel version that includes this patch. Since this is a kernel-level fix, no additional mitigation is required beyond applying the official patch when available. Patch status is not yet confirmed in the provided data; check the vendor or Linux kernel advisories for the current remediation guidance.