CVE-2026-98814: nvme: fix command effects log lifetime for multipath heads
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:
BUG: KASAN: slab-use-after-free in nvmecommandeffects+0x192/0x200 [nvmecore] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvmecommandeffects+0x192/0x200 [nvmecore] nvmecmdallowed+0x7e/0x1b0 [nvmecore] nvmeusercmd.constprop.0+0x1b5/0x450 [nvmecore] nvmensheadchrioctl+0xf4/0x2a0 [nvmecore]
Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
Affected Software
Event History
Frequently Asked Questions
Which systems are exposed to this issue?
Systems using the Linux NVMe multipath functionality are exposed when an I/O passthrough command is issued through a multipath namespace head after the controller path that originally created that head has been removed.
What condition is required to trigger the use-after-free?
An attacker or local process must be able to send an I/O passthrough command through a multipath namespace head. The triggering condition occurs after removal of the controller path that first created the namespace head.
How can I determine whether the vulnerable path has been encountered?
Look for KASAN slab-use-after-free reports involving nvme_command_effects, nvme_cmd_allowed, nvme_user_cmd, and nvme_ns_head_chr_ioctl. The reported access is a read from freed command-effects-log memory.