{"id":"CVE-2026-98814","kind":"vulnerability","aliases":["CVE-2026-98814"],"related":[],"title":"Linux kernel NVMe: use-after-free when passthrough commands hit multipath heads","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix command effects log lifetime for multipath heads\n\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\n\n  BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]\n  Read of size 4 at addr ffff888141b14400 by task nvme/19811\n  nvme_command_effects+0x192/0x200 [nvme_core]\n  nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]\n  nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]\n  nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]\n\nMove the log cache to the subsystem, with one entry per command set. Both\ncontrollers and namespace heads hold subsystem references, keeping their\nlog pointers valid until subsystem release.","summary":"The Linux kernel NVMe driver can read a freed command effects log when an I/O passthrough command goes through a multipath namespace head after the controller path that created it was removed. The sources describe a KASAN-reported use-after-free and the fix moves the log cache to the subsystem so its lifetime is tied to the subsystem.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","nvme","other","self-hosted","storage"],"not_affected_if":["no-nvme-multipath"],"how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, which the sources do not give.\n- Check whether the NVMe multipath feature is in use on the host with `cat /sys/module/nvme_core/parameters/multipath` (unknown if the sources say this exact path).","fix":"- Update the Linux kernel to a release that includes the upstream nvme fix for command effects log lifetime on multipath heads (the fixed version is unknown from the sources).","status":"open","published_at":"2026-10-18T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:49+00:00","updated_at":"2026-10-25T05:14:49+00:00","category":"other","confidence":0.4,"triage":{"at":"2026-10-25T05:14:49Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream nvme fix for command effects log lifetime on multipath heads (the fixed version is unknown from the sources).","reach":"local","title":"Linux kernel NVMe: use-after-free when passthrough commands hit multipath heads","impact":"high","summary":"The Linux kernel NVMe driver can read a freed command effects log when an I/O passthrough command goes through a multipath namespace head after the controller path that created it was removed. The sources describe a KASAN-reported use-after-free and the fix moves the log cache to the subsystem so its lifetime is tied to the subsystem.","category":"other","nicknames":[],"who_cares":["linux","kernel","nvme","storage","self-hosted"],"confidence":0.4,"needs_auth":"yes","worst_case":"Kernel memory use-after-free could lead to a crash or code execution","analyst_note":"Find the affected and fixed kernel versions and the upstream commit in the kernel.org stable advisory for CVE-2026-98814 or the NVD entry.","how_to_check":"- Run `uname -r` and compare against the kernel version that carries the fix, which the sources do not give.\n- Check whether the NVMe multipath feature is in use on the host with `cat /sys/module/nvme_core/parameters/multipath` (unknown if the sources say this exact path).","needs_analyst":true,"not_affected_if":["no-nvme-multipath"],"who_is_affected":"Hosts running a Linux kernel with the NVMe multipath namespace-head code that send I/O passthrough commands such as nvme-cli user commands through multipath heads. The sources do not state which kernel versions are affected or whether an ordinary user path is reachable; systems not using NVMe multipath are unlikely to be exposed.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000684,"input_tokens":3568,"output_tokens":654,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':150C,167C,174C,180C,189C '-2026':15A,18A '-98814':16A,19A '0':179C '4':157C 'addr':159C 'allow':173C 'bug':139C 'cach':77B,196C 'chr':187C 'cmd':172C 'command':10A,37B,44B,101C,119C,148C,165C,204C 'control':53B,129C,207C 'core':153C,170C,177C,183C,192C 'creat':56B,133C 'cve':14A,17A 'describ':62B 'driver':32B 'effect':38B,102C,149C,166C 'entri':202C 'ffff888141b14400':160C 'first':132C 'fix':73B,100C 'follow':94C 'free':7A,70B,114C,145C 'freed':36B 'goe':45B 'head':13A,50B,107C,126C,135C,186C,210C 'hit':11A 'hold':211C 'host':26B 'i/o':42B,117C 'ioctl':188C 'kasan':65B,108C,140C 'kasan-report':64B 'keep':214C 'kernel':2A,20B,30B,92C 'lifetim':83B,104C 'linux':1A,21B,29B,91C 'log':39B,76B,103C,195C,216C 'move':74B,193C 'multipath':12A,48B,106C,124C 'namespac':49B,125C,209C 'ns':185C 'nvme':3A,22B,31B,99C,147C,152C,164C,169C,171C,176C,182C,184C,191C 'nvme/19811':163C 'nvme_user_cmd.constprop':178C 'one':201C 'passthrough':9A,43B,118C 'path':54B,130C 'per':203C 'pointer':217C 'read':34B,154C 'refer':213C 'releas':221C 'remov':59B,138C 'report':66B,109C 'resolv':98C 'self':25B 'self-host':24B 'sent':121C 'set':205C 'size':156C 'slab':142C 'slab-use-after-fre':141C 'sourc':61B 'storag':27B 'subsystem':80B,88B,199C,212C,220C 'task':162C 'tie':85B 'use':5A,68B,112C,143C 'use-after-fre':4A,67B,111C 'valid':218C 'vulner':95C 'x192/0x200':151C,168C 'x1b5/0x450':181C 'x7e/0x1b0':175C 'xf4/0x2a0':190C","nicknames":[],"mitigations":[],"who_affected":"Hosts running a Linux kernel with the NVMe multipath namespace-head code that send I/O passthrough commands such as nvme-cli user commands through multipath heads. The sources do not state which kernel versions are affected or whether an ordinary user path is reachable; systems not using NVMe multipath are unlikely to be exposed.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98814","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98814","severity":null,"published_at":"2026-10-18T16:17:35+00:00","modified_at":"2026-10-19T10:19:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}