How do I check whether I am affected by CVE-2026-98815?

- Check for NVMe namespace character devices with `ls /dev/ng*`. - Check whether the kernel is built with NVMe multipath, for example `grep CONFIG_NVME_MULTIPATH /boot/config-$(uname -r)`. - Check the running kernel version with `uname -r` against the fixed release, which the sources do not name.

What is the fix for CVE-2026-98815?

- Apply the upstream kernel fix titled "nvme: fix cdev lifetime", version unknown. - Move to a distribution kernel that includes that fix, version unknown.

Who is not affected by CVE-2026-98815?

Not affected if: no-ng-char-devices, no-nvme-multipath.

Live › vulnerability › CVE-2026-98815

Go to dashboard

unknownInfrastructure

Linux kernel NVMe: use-after-free in char device after namespace teardown

In NVMe multipath mode, the kernel can tear down a namespace head while a character device opened on it stays usable, so later calls on that device touch freed memory. A local user who holds the device open across the teardown can trigger a KASAN-reported use-after-free read in the kernel.

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Local user reads freed kernel memory, possibly crashing the system.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Systems running a Linux kernel with NVMe multipath enabled, where the NVMe namespace head is torn down while user space still has its character device open. Hosts without NVMe multipath or without NVMe character devices are not exposed by the description.

Know the next one before it finds you.

Add to Slack

Live › vulnerability › CVE-2026-98815

Go to dashboard

unknownInfrastructure

Linux kernel NVMe: use-after-free in char device after namespace teardown

Summary written from the sources below. Check the originals before acting.

Known so far

3/6

unknown

no CVSS yet; severity from the sources

known so far3 of 6

missing: versions, primary source, exploitation

First public: Oct 18, 2026 UTC
Last modified: Oct 19, 2026
Status: open
Known exploitation: None reported
Public exploit: None on GitHub
EPSS: not scored

First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.

Why it is unknown, and not just CVSS

Likelihood → · Impact ↓

critical

high

medium

high

medium

low

medium

low

Exploited: No reports yet.
Needs login: Not known from the sources.
Needs a special setup: Yes.
Reachable from: local.
Worst case: Local user reads freed kernel memory, possibly crashing the system.
CVSS said: No score. The facts above say low; we keep the sources' unknown until an analyst looks.

Who is affected

Know the next one before it finds you.

Add to Slack

Linux kernel NVMe: use-after-free in char device after namespace teardown

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

Linux kernel NVMe: use-after-free in char device after namespace teardown

Why it is unknown, and not just CVSS

Who is affected

Know the next one before it finds you.

How to check

The fix

Who had it, and when

What the sources say, verbatim

./ioctl_file /dev/ng1n1 &

waiting 10 seconds ....

./ini_nvme_teardown.sh

now going to issue ioctl ....

Sources