CVE-2026-98814: nvme: fix command effects log lifetime for multipath heads

Published Oct 18, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix command effects log lifetime for multipath heads

KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:

BUG: KASAN: slab-use-after-free in nvmecommandeffects+0x192/0x200 [nvmecore] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvmecommandeffects+0x192/0x200 [nvmecore] nvmecmdallowed+0x7e/0x1b0 [nvmecore] nvmeusercmd.constprop.0+0x1b5/0x450 [nvmecore] nvmensheadchrioctl+0xf4/0x2a0 [nvmecore]

Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.

Affected Software

1 affected component

Linux Linux kernel

Event History

Oct 18, 2026

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Data Sourced

via NVD·04:17 PM

Description

Frequently Asked Questions

Which systems are exposed to this issue?

Systems using the Linux NVMe multipath functionality are exposed when an I/O passthrough command is issued through a multipath namespace head after the controller path that originally created that head has been removed.

What condition is required to trigger the use-after-free?

An attacker or local process must be able to send an I/O passthrough command through a multipath namespace head. The triggering condition occurs after removal of the controller path that first created the namespace head.

How can I determine whether the vulnerable path has been encountered?

Look for KASAN slab-use-after-free reports involving nvme_command_effects, nvme_cmd_allowed, nvme_user_cmd, and nvme_ns_head_chr_ioctl. The reported access is a read from freed command-effects-log memory.

CVE-2026-98814: nvme: fix command effects log lifetime for multipath heads

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What condition is required to trigger the use-after-free?

How can I determine whether the vulnerable path has been encountered?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What condition is required to trigger the use-after-free?

How can I determine whether the vulnerable path has been encountered?