{"id":"CVE-2026-98815","kind":"vulnerability","aliases":["CVE-2026-98815"],"related":[],"title":"Linux kernel NVMe: use-after-free in char device after namespace teardown","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix cdev lifetime\n\nSashiko bot reported a potential problem for the cdev lifetime in [0]\n- the code there is heavily based on the NVMe code.\n\nCurrently the NS head .open and .release file_operations methods take and\nput a reference to the nvme_ns_head to ensure that this structure does not\ndisappear while we open fds for that cdev.\n\nIn multipath mode, when we teardown the NS head, we call nvme_cdev_del() ->\ncdev_device_del() -> cdev_del(). However after cdev_del() returns, cdevs\nalready open will remain and their fops will still be callable. As such,\nwe can still reference the cdev after the nvme_ns_head reference count\ndrops to 0 (and is freed).\n\nThis can be shown with an application which delays between opening the cdev\nand issuing the ioctl while the NS head is being torn down:\n\n# ./ioctl_file /dev/ng1n1 &\n# waiting 10 seconds ....\n\n# ./ini_nvme_teardown.sh\n[   21.221718] nvme nvme1: Removing ctrl: NQN \"nvme-test-target\"\n[   21.274609] nvme nvme2: Removing ctrl: NQN \"nvme-test-target\"\n# now going to issue ioctl ....\n[   26.549285] ==================================================================\n[   26.550841] BUG: KASAN: slab-use-after-free in cdev_put.part.0+0x3d/0x40\n[   26.552352] Read of size 8 at addr ffff88811e7fa170 by task ioctl_file/237\n[   26.553805]\n[   26.554227] CPU: 3 UID: 0 PID: 237 Comm: ioctl_file Not tainted 7.2.0-rc1-00004-g6852a10e32d4 #921 PREEMPT(lazy)\n[   26.554236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n[   26.554241] Call Trace:\n[   26.554245]  <TASK>\n[   26.554248]  dump_stack_lvl+0x68/0xa0\n[   26.554266]  print_report+0x10d/0x5d0\n[   26.554276]  ? __virt_addr_valid+0x21d/0x3f0\n[   26.554287]  ? cdev_put.part.0+0x3d/0x40\n[   26.554292]  kasan_report+0x96/0xd0\n[   26.554300]  ? cdev_put.part.0+0x3d/0x40\n[   26.554307]  cdev_put.part.0+0x3d/0x40\n[   26.554313]  __fput+0x7bc/0xa70\n[   26.554322]  fput_close_sync+0xd8/0x190\n[   26.554328]  ? __pfx_fput_close_sync+0x10/0x10\n[   26.554337]  __x64_sys_close+0x79/0xd0\n[   26.554344]  do_syscall_64+0x117/0x6b0\n[   26.554351]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n[   26.554358] RIP: 0033:0x7f938c067727\n[   26.554364] Code: 48 89 fa 4c 89 df e8 28 ad 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5bf\n[   26.554369] RSP: 002b:00007fff49f05980 EFLAGS: 00000202 ORIG_RAX: 0000000000000003\n[   26.554376] RAX: ffffffffffffffda RBX: 00007f938bfd7780 RCX: 00007f938c067727\n[   26.554380] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003\n[   26.554383] RBP: 00007fff49f05a10 R08: 0000000000000000 R09: 0000000000000000\n[   26.554386] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000\n[   26.554389] R13: 00007fff49f05b40 R14: 00007f938c207000 R15: 000055c148471d78\n[   26.554397]  </TASK>\n[   26.554399]\n[   26.575612] Allocated by task 100:\n[   26.575871]  kasan_save_stack+0x24/0x50\n[   26.576157]  kasan_save_track+0x14/0x30\n[   26.576418]  __kasan_kmalloc+0x7f/0x90\n[   26.576668]  __kmalloc_noprof+0x281/0x6c0\n[   26.576938]  nvme_alloc_ns+0x7f7/0x3170\n[   26.577206]  nvme_scan_ns+0x508/0x880\n[   26.577449]  async_run_entry_fn+0x8c/0x350\n[   26.577723]  process_scheduled_works+0xb6f/0x1a00\n[   26.578034]  worker_thread+0x4ad/0xb40\n[   26.578283]  kthread+0x34f/0x450\n[   26.578501]  ret_from_fork+0x563/0x800\n[   26.578752]  ret_from_fork_asm+0x1a/0x30\n[   26.579012]\n[   26.579124] Freed by task 237:\n[   26.579335]  kasan_save_stack+0x24/0x50\n[   26.579596]  kasan_save_track+0x14/0x30\n[   26.579855]  kasan_save_free_info+0x3a/0x60\n[   26.580131]  __kasan_slab_free+0x43/0x70\n[   26.580388]  kfree+0x321/0x500\n[   26.580591]  nvme_ns_head_chr_release+0x39/0x50\n[   26.580883]  __fput+0x352/0xa70\n[   26.581095]  fput_close_sync+0xd8/0x190\n[   26.581350]  __x64_sys_close+0x79/0xd0\n[   26.581595]  do_syscall_64+0x117/0x6b0\n[   26.581842]  entry_SYSCAL\n---truncated---","summary":"In NVMe multipath mode, the kernel can tear down a namespace head while a character device opened on it stays usable, so later calls on that device touch freed memory. A local user who holds the device open across the teardown can trigger a KASAN-reported use-after-free read in the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","multipath","nvme","self-hosted"],"not_affected_if":["no-ng-char-devices","no-nvme-multipath"],"how_to_check":"- Check for NVMe namespace character devices with `ls /dev/ng*`.\n- Check whether the kernel is built with NVMe multipath, for example `grep CONFIG_NVME_MULTIPATH /boot/config-$(uname -r)`.\n- Check the running kernel version with `uname -r` against the fixed release, which the sources do not name.","fix":"- Apply the upstream kernel fix titled \"nvme: fix cdev lifetime\", version unknown.\n- Move to a distribution kernel that includes that fix, version unknown.","status":"open","published_at":"2026-10-18T16:17:35+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:14:55+00:00","updated_at":"2026-10-25T05:14:55+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:14:55Z","model":"claude-haiku-5-5","output":{"fix":"- Apply the upstream kernel fix titled \"nvme: fix cdev lifetime\", version unknown.\n- Move to a distribution kernel that includes that fix, version unknown.","reach":"local","title":"Linux kernel NVMe: use-after-free in char device after namespace teardown","impact":"medium","summary":"In NVMe multipath mode, the kernel can tear down a namespace head while a character device opened on it stays usable, so later calls on that device touch freed memory. A local user who holds the device open across the teardown can trigger a KASAN-reported use-after-free read in the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","nvme","multipath","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local user reads freed kernel memory, possibly crashing the system","analyst_note":"","how_to_check":"- Check for NVMe namespace character devices with `ls /dev/ng*`.\n- Check whether the kernel is built with NVMe multipath, for example `grep CONFIG_NVME_MULTIPATH /boot/config-$(uname -r)`.\n- Check the running kernel version with `uname -r` against the fixed release, which the sources do not name.","needs_analyst":false,"not_affected_if":["no-nvme-multipath","no-ng-char-devices"],"who_is_affected":"Systems running a Linux kernel with NVMe multipath enabled, where the NVMe namespace head is torn down while user space still has its character device open. Hosts without NVMe multipath or without NVMe character devices are not exposed by the description.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.001424,"input_tokens":5355,"output_tokens":1776,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':280C,337C,342C,348C,353C,358C,363C,368C,372C,378C,385C,391C,397C,405C,511C,517C,522C,527C,533C,539C,546C,552C,557C,561C,567C,574C,586C,592C,599C,605C,609C,617C,621C,627C,633C,639C '-00004':309C '-2':327C '-2026':15A,18A '-98815':16A,19A '/dev/ng1n1':238C '/ini_nvme_teardown.sh':242C '/ioctl_file':237C '0':109C,208C,279C,299C,352C,362C,367C '00':422C,423C,428C,429C,443C,444C,445C,446C,447C '0000000000000000':474C,476C,483C,485C,488C,492C '0000000000000003':464C,478C '0000000000000202':490C '00000202':461C '000055c148471d78':499C '00007f938bfd7780':469C '00007f938c067727':471C '00007f938c207000':497C '00007fff49f05980':459C '00007fff49f05a10':481C '00007fff49f05b40':495C '002b':458C '0033':409C '03':427C '04/01/2014':328C '05':454C '08':426C '0f':440C,453C '0x7f938c067727':410C '1.16.3':324C,326C '10':240C,452C '100':506C '1a':437C '1f':441C '2009':322C '21.221718':243C '21.274609':253C '237':301C,581C '24':451C '26.549285':268C '26.550841':269C '26.552352':282C '26.553805':294C '26.554227':295C '26.554236':314C '26.554241':329C '26.554245':332C '26.554248':333C '26.554266':339C '26.554276':344C '26.554287':350C '26.554292':355C '26.554300':360C '26.554307':365C '26.554313':370C '26.554322':374C '26.554328':380C '26.554337':387C '26.554344':393C '26.554351':399C '26.554358':407C '26.554364':411C '26.554369':456C '26.554376':465C '26.554380':472C '26.554383':479C '26.554386':486C '26.554389':493C '26.554397':500C '26.554399':501C '26.575612':502C '26.575871':507C '26.576157':513C '26.576418':519C '26.576668':524C '26.576938':529C '26.577206':535C '26.577449':541C '26.577723':548C '26.578034':554C '26.578283':559C '26.578501':563C '26.578752':569C '26.579012':576C '26.579124':577C '26.579335':582C '26.579596':588C '26.579855':594C '26.580131':601C '26.580388':607C '26.580591':611C '26.580883':619C '26.581095':623C '26.581350':629C '26.581595':635C '26.581842':641C '28':420C '3':297C '44':450C '48':413C,432C,448C '4c':416C '59':430C '5b':438C '5bf':455C '5e':431C '64':396C,402C,638C '7.2.0':307C '74':436C '8':286C '83':433C '84':442C '89':414C,417C '8b':424C,449C '921':311C '93':425C 'across':67B 'ad':421C 'addr':288C,346C 'alloc':503C,531C 'alreadi':180C 'applic':218C 'asm':573C 'async':542C 'base':115C 'bio':323C 'bot':99C 'bug':270C 'c3':439C 'call':52B,165C,330C 'callabl':190C 'cdev':96C,106C,154C,167C,169C,172C,176C,179C,198C,224C 'cdev_put.part':278C,351C,361C,366C 'char':9A 'charact':43B 'chr':615C 'close':376C,383C,390C,625C,632C 'code':111C,119C,412C 'comm':302C 'count':205C 'cpu':296C 'ctrl':247C,257C 'current':120C 'cve':14A,17A 'debian':325C 'del':168C,171C,173C,177C 'delay':220C 'devic':10A,44B,55B,65B,170C 'df':418C 'disappear':147C 'drop':206C 'dump':334C 'e8':419C 'eflag':460C 'ensur':141C 'entri':400C,544C,642C 'f8':434C 'fa':415C 'fc':435C 'fds':151C 'ffff88811e7fa170':289C 'ffffffffffffffda':467C 'file':127C,304C 'file/237':293C 'fix':95C 'fn':545C 'follow':89C 'fop':186C 'fork':566C,572C 'fput':371C,375C,382C,620C,624C 'free':7A,79B,276C,597C,604C 'freed':57B,211C,578C 'g6852a10e32d4':310C 'go':264C 'hardwar':315C 'head':40B,123C,139C,163C,203C,232C,614C 'heavili':114C 'hold':63B 'host':28B 'howev':174C 'hwframe':404C 'ich9':321C 'info':598C 'infrastructur':20B 'ioctl':228C,267C,292C,303C 'issu':226C,266C 'kasan':74B,271C,356C,508C,514C,520C,583C,589C,595C,602C 'kasan-report':73B 'kernel':2A,23B,34B,83B,87C 'kfree':608C 'kmalloc':521C,525C 'kthread':560C 'later':51B 'lazi':313C 'lifetim':97C,107C 'linux':1A,22B,86C 'linux-kernel':21B 'local':60B 'lvl':336C 'memori':58B 'method':129C 'mode':32B,157C 'multipath':24B,31B,156C 'name':316C 'namespac':12A,39B 'noprof':526C 'nqn':248C,258C 'ns':122C,138C,162C,202C,231C,532C,538C,613C 'nvme':3A,25B,30B,94C,118C,137C,166C,201C,244C,250C,254C,260C,530C,536C,612C 'nvme-test-target':249C,259C 'nvme1':245C 'nvme2':255C 'open':45B,66B,124C,150C,181C,222C 'oper':128C 'orig':462C 'pc':319C 'pfx':381C 'pid':300C 'potenti':102C 'preempt':312C 'print':340C 'problem':103C 'process':549C 'put':132C 'q35':320C 'qemu':317C 'r08':482C 'r09':484C 'r10':487C 'r11':489C 'r12':491C 'r13':494C 'r14':496C 'r15':498C 'rax':463C,466C 'rbp':480C 'rbx':468C 'rc1':308C 'rcx':470C 'rdi':477C 'rdx':473C 'read':80B,283C 'refer':134C,196C,204C 'releas':126C,616C 'remain':183C 'remov':246C,256C 'report':75B,100C,341C,357C 'resolv':93C 'ret':564C,570C 'return':178C 'rip':408C 'rsi':475C 'rsp':457C 'run':543C 'sashiko':98C 'save':509C,515C,584C,590C,596C 'scan':537C 'schedul':550C 'second':241C 'self':27B 'self-host':26B 'shown':215C 'size':285C 'slab':273C,603C 'slab-use-after-fre':272C 'stack':335C,510C,585C 'standard':318C 'stay':48B 'still':188C,195C 'structur':144C 'sync':377C,384C,626C 'sys':389C,631C 'syscal':395C,401C,637C,643C 'taint':306C 'take':130C 'target':252C,262C 'task':291C,505C,580C 'tear':36B 'teardown':13A,69B,160C 'test':251C,261C 'thread':556C 'torn':235C 'touch':56B 'trace':331C 'track':516C,591C 'trigger':71B 'truncat':644C 'uid':298C 'usabl':49B 'use':5A,77B,274C 'use-after-fre':4A,76B 'user':61B 'valid':347C 'virt':345C 'vulner':90C 'wait':239C 'work':551C 'worker':555C 'x10/0x10':386C 'x10d/0x5d0':343C 'x117/0x6b0':398C,640C 'x14/0x30':518C,593C 'x1a/0x30':575C 'x21d/0x3f0':349C 'x24/0x50':512C,587C 'x281/0x6c0':528C 'x321/0x500':610C 'x34f/0x450':562C 'x352/0xa70':622C 'x39/0x50':618C 'x3a/0x60':600C 'x3d/0x40':281C,354C,364C,369C 'x43/0x70':606C 'x4ad/0xb40':558C 'x508/0x880':540C 'x563/0x800':568C 'x64':388C,630C 'x68/0xa0':338C 'x77/0x7f':406C 'x79/0xd0':392C,634C 'x7bc/0xa70':373C 'x7f/0x90':523C 'x7f7/0x3170':534C 'x8c/0x350':547C 'x96/0xd0':359C 'xb6f/0x1a00':553C 'xd8/0x190':379C,628C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with NVMe multipath enabled, where the NVMe namespace head is torn down while user space still has its character device open. Hosts without NVMe multipath or without NVMe character devices are not exposed by the description.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:35+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98815","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98815","severity":null,"published_at":"2026-10-18T16:17:35+00:00","modified_at":"2026-10-19T10:19:45+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}