CVE-2026-98814 nvme: fix command effects log lifetime for multipath heads
A use-after-free in the Linux kernel NVMe driver allows local attackers to cause a system crash or potentially execute code via I/O passthrough commands.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98814?
CVE-2026-98814 is an use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
Which versions are affected by CVE-2026-98814?
How do I fix CVE-2026-98814?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98814 being exploited?
There is no known exploitation of CVE-2026-98814 in the wild and no public exploit code.
Sources
Also known as AZL-108890, BELL-CVE-2026-98814, DEBIAN-CVE-2026-98814, GHSA-pjx2-xpm7-hwm6, UBUNTU-CVE-2026-98814.