CVE-2026-98814
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:
Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
Technical details traces, logs and code from the original report
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
CVSS
NVD hasn't assigned a CVSS score to this CVE (common since the April 2026 policy change).
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days
- 0.16 %
- Percentile among all scored CVEs
- 5
- Score date
- 10/20/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (1)
⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.
References
Raw JSON (NVD)
Show
{
"id": "CVE-2026-98814",
"cveTags": [],
"metrics": {},
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3",
"lessThan": "351d1c47e45b2b35780d0548b1012d7242ba298d",
"versionType": "git"
},
{
"status": "affected",
"version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3",
"lessThan": "72ece656abd4de8645a421fb482d7a11e6533a45",
"versionType": "git"
}
],
"programFiles": [
"drivers/nvme/host/core.c",
"drivers/nvme/host/nvme.h"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "5.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "5.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "7.2.10",
"versionType": "semver",
"lessThanOrEqual": "7.2.*"
},
{
"status": "unaffected",
"version": "7.3",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/nvme/host/core.c",
"drivers/nvme/host/nvme.h"
],
"defaultStatus": "affected"
}
]
}
],
"published": "2026-10-18T16:17:35.540",
"references": [
{
"url": "https://git.kernel.org/stable/c/351d1c47e45b2b35780d0548b1012d7242ba298d",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
},
{
"url": "https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"vulnStatus": "Received",
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix command effects log lifetime for multipath heads\n\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\n\n BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]\n Read of size 4 at addr ffff888141b14400 by task nvme/19811\n nvme_command_effects+0x192/0x200 [nvme_core]\n nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]\n nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]\n nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]\n\nMove the log cache to the subsystem, with one entry per command set. Both\ncontrollers and namespace heads hold subsystem references, keeping their\nlog pointers valid until subsystem release."
}
],
"lastModified": "2026-10-19T10:19:45.467",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}