Cloudanix VulnDB

CVE-2026-98814

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in how Linux handles certain storage commands on systems with multiple NVMe paths can cause crashes or let attackers gain extra access if they time commands after a storage path is removed.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in nvme_command_effects when an I/O passthrough command is issued against a multipath namespace head whose originating controller path has already been removed, causing a read of slab memory that has been freed.

Why it matters to the business

Linux systems using NVMe multipath storage face risk of kernel crashes, memory corruption, or potential privilege escalation; the issue affects recent kernels and requires prompt patching to maintain storage subsystem stability.

How an attack unfolds

An attacker with local access identifies a multipath NVMe namespace, removes the controller path that created the head, then issues a passthrough ioctl that calls nvme_cmd_allowed and nvme_command_effects, dereferencing the now-freed command-effects log.

How to fix it

Update to a kernel containing the fix that relocates the command-effects log cache to the subsystem object with one entry per command set so that references remain valid until subsystem release.

How to confirm the fix worked

Verify the presence of the subsystem-level log cache in the nvme_core module source or running kernel; confirm no KASAN reports occur during multipath path removal followed by passthrough ioctls.

Typical attack path

  1. Locate multipath NVMe namespace head on target system
  2. Remove the controller path that instantiated the namespace head
  3. Issue NVMe user passthrough command via the namespace head character device
  4. Trigger nvme_command_effects read of freed memory

How to detect it

Search kernel logs and audit trails for KASAN use-after-free reports referencing nvme_command_effects or nvme_ns_head_chr_ioctl around the time of controller removal events; review dmesg and systemd journal for slab-use-after-free stack traces.

What your security team should do

  • Prioritize kernel update on all Linux hosts using NVMe multipath within the next maintenance window
  • Monitor vendor advisories for backported fixes in supported distributions
  • Restrict unprivileged access to NVMe character devices until patched

The record

In the Linux kernel, the following vulnerability has been resolved: nvme: fix command effects log lifetime for multipath heads KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed: BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core] Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.

Affected packages

Ecosystem Package Introduced Fixed