---
id: "CVE-2026-98814"
kind: "vulnerability"
aliases: ["CVE-2026-98814"]
title: "Linux kernel NVMe: use-after-free when passthrough commands hit multipath heads"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["kernel", "linux", "nvme", "other", "self-hosted", "storage"]
not_affected_if: ["no-nvme-multipath"]
published_at: "2026-10-18T16:17:35+00:00"
first_seen_at: "2026-10-23T21:57:17+00:00"
updated_at: "2026-10-25T05:14:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98814", "first_seen_at": "2026-10-23T21:57:17+00:00"}]
---

# Linux kernel NVMe: use-after-free when passthrough commands hit multipath heads

The Linux kernel NVMe driver can read a freed command effects log when an I/O passthrough command goes through a multipath namespace head after the controller path that created it was removed. The sources describe a KASAN-reported use-after-free and the fix moves the log cache to the subsystem so its lifetime is tied to the subsystem.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Run `uname -r` and compare against the kernel version that carries the fix, which the sources do not give.
- Check whether the NVMe multipath feature is in use on the host with `cat /sys/module/nvme_core/parameters/multipath` (unknown if the sources say this exact path).

## Fix

- Update the Linux kernel to a release that includes the upstream nvme fix for command effects log lifetime on multipath heads (the fixed version is unknown from the sources).

## Timeline

- 2026-10-23T21:57:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98814

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix command effects log lifetime for multipath heads

KASAN reported a use-after-free when an I/O passthrough command was sent
through a multipath namespace head after the controller path that first
created the head had been removed:

  BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]
  Read of size 4 at addr ffff888141b14400 by task nvme/19811
  nvme_command_effects+0x192/0x200 [nvme_core]
  nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]
  nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]
  nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]

Move the log cache to the subsystem, with one entry per command set. Both
controllers and namespace heads hold subsystem references, keeping their
log pointers valid until subsystem release.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_