CVE-2026-98814
Received Received - Intake

Use-After-Free in Linux Kernel NVMe Subsystem

Publication date: 2026-10-18

Last updated on: 2026-10-18

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed: BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core] Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-18
Last Modified
2026-10-18
Generated
2026-10-18
AI Q&A
2026-10-18
EPSS Evaluated
N/A
NVD
CVE-2026-98814
EUVD
EUVD-2026-103899

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Linux Linux be93e87e780253780df9bb6ecc9bc1199b0d94c3
Linux Linux be93e87e780253780df9bb6ecc9bc1199b0d94c3
Linux Linux 5.9

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free bug in the Linux kernel's NVMe driver. It occurs when an I/O passthrough command is sent through a multipath namespace head after the controller path that created the head has been removed. This leads to a kernel crash due to accessing freed memory.

Detection Guidance

This vulnerability is specific to the Linux kernel's NVMe driver and may not have direct network detection methods. Monitor kernel logs for KASAN errors or slab-use-after-free messages related to nvme_command_effects. Check for crashes in nvme/ processes or I/O passthrough failures in multipath setups.

Impact Analysis

This vulnerability can cause system instability or crashes when using NVMe devices with multipath configurations. It may lead to data corruption or denial of service if exploited.

Mitigation Strategies

Update the Linux kernel to a patched version that resolves this issue. Avoid using multipath namespace heads for I/O passthrough commands until the fix is applied. Monitor system logs for related errors as an indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-98814. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart