Live › vulnerability › CVE-2026-98814
Go to dashboardThe Linux kernel NVMe driver can read a freed command effects log when an I/O passthrough command goes through a multipath namespace head after the controller path that created it was removed. The sources describe a KASAN-reported use-after-free and the fix moves the log cache to the subsystem so its lifetime is tied to the subsystem.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Hosts running a Linux kernel with the NVMe multipath namespace-head code that send I/O passthrough commands such as nvme-cli user commands through multipath heads. The sources do not state which kernel versions are affected or whether an ordinary user path is reachable; systems not using NVMe multipath are unlikely to be exposed.
No product ranges from the sources yet.
uname -r and compare against the kernel version that carries the fix, which the sources do not give.cat /sys/module/nvme_core/parameters/multipath (unknown if the sources say this exact path).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
This page as .md · .json · in your agent: get_signal("CVE-2026-98814")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.