CVE-2026-98154

What it actually does

Incorrect error handling in the nvme-rdma queue_rq path performs DMA unmap and command cleanup after the request has already been completed by the host path error helper, resulting in double-free and use-after-free conditions on the SQE and associated structures.

Why it matters to the business

Local attackers on systems using NVMe over RDMA can trigger kernel memory corruption, leading to crashes, data loss, or potential privilege escalation; the flaw affects storage subsystems in Linux environments with high-availability or cloud workloads.

How an attack unfolds

An attacker with local access crafts I/O operations that force an -EIO condition in the RDMA queue path; the buggy cleanup sequence then performs DMA unmap and command teardown after request completion, corrupting kernel memory structures that can be leveraged for arbitrary code execution.

How to fix it

Apply the upstream fix that reorders the SQE unmap before the host path error report and skips the outer command cleanup; rebuild and deploy updated Linux kernel packages containing the corrected nvme-rdma logic as soon as they become available from the distribution.

How to confirm the fix worked

Confirm the kernel source contains the corrected order (unmap SQE first, then report path error, and elide the redundant cleanup); test by injecting -EIO conditions in the RDMA queue path and verifying no double completion or DMA unmap-after-complete occurs.

Typical attack path

1. Obtain local user access on an affected Linux system with nvme-rdma enabled
2. Trigger I/O workloads that induce -EIO errors on the RDMA queue
3. Exploit the resulting double cleanup and DMA unmap-after-complete to corrupt kernel memory
4. Escalate privileges or cause denial of service via the memory corruption

How to detect it

Search kernel logs and crash dumps for nvme-rdma queue_rq error paths that reference -EIO followed by repeated completion or DMA unmap warnings; inspect for use-after-free or double-free reports involving RDMA SQE structures.

What your security team should do

• Prioritize kernel updates for all systems using nvme-rdma storage
• Restrict local access on storage or hypervisor hosts until patched
• Monitor kernel oops and panic logs for nvme-rdma related corruption signatures
• Evaluate disabling nvme-rdma if the workload can tolerate alternative transports