CVE-2026-98814

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98814", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.371Z", "datePublished": "2026-10-18T15:49:01.538Z", "dateUpdated": "2026-10-19T09:26:07.427Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:26:07.427Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix command effects log lifetime for multipath heads\n\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\n\n BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]\n Read of size 4 at addr ffff888141b14400 by task nvme/19811\n nvme_command_effects+0x192/0x200 [nvme_core]\n nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]\n nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]\n nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]\n\nMove the log cache to the subsystem, with one entry per command set. Both\ncontrollers and namespace heads hold subsystem references, keeping their\nlog pointers valid until subsystem release."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/core.c", "drivers/nvme/host/nvme.h"], "versions": [{"version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3", "lessThan": "351d1c47e45b2b35780d0548b1012d7242ba298d", "status": "affected", "versionType": "git"}, {"version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3", "lessThan": "72ece656abd4de8645a421fb482d7a11e6533a45", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/nvme/host/core.c", "drivers/nvme/host/nvme.h"], "versions": [{"version": "5.9", "status": "affected"}, {"version": "0", "lessThan": "5.9", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.10", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.2.10"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.9", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/351d1c47e45b2b35780d0548b1012d7242ba298d"}, {"url": "https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}], "title": "nvme: fix command effects log lifetime for multipath heads", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/nvme/host/core.c", "drivers/nvme/host/nvme.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "351d1c47e45b2b35780d0548b1012d7242ba298d", "status": "affected", "version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3", "versionType": "git"}, {"lessThan": "72ece656abd4de8645a421fb482d7a11e6533a45", "status": "affected", "version": "be93e87e780253780df9bb6ecc9bc1199b0d94c3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/nvme/host/core.c", "drivers/nvme/host/nvme.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.9"}, {"lessThan": "5.9", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.10", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnvme: fix command effects log lifetime for multipath heads\n\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\n\n BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]\n Read of size 4 at addr ffff888141b14400 by task nvme/19811\n nvme_command_effects+0x192/0x200 [nvme_core]\n nvme_cmd_allowed+0x7e/0x1b0 [nvme_core]\n nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]\n nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]\n\nMove the log cache to the subsystem, with one entry per command set. Both\ncontrollers and namespace heads hold subsystem references, keeping their\nlog pointers valid until subsystem release."}], "id": "CVE-2026-98814", "lastModified": "2026-10-19T10:19:45.467", "metrics": {}, "published": "2026-10-18T16:17:35.540", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/351d1c47e45b2b35780d0548b1012d7242ba298d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/72ece656abd4de8645a421fb482d7a11e6533a45"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: nvme: fix command effects log lifetime for multipath heads", "id": "2555231", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2555231"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.4", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nnvme: fix command effects log lifetime for multipath heads\nKASAN reported a use-after-free when an I/O passthrough command was sent\nthrough a multipath namespace head after the controller path that first\ncreated the head had been removed:\nBUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core]\nRead of size 4 at addr ffff888141b14400 by task nvme/19811\nnvme_command_effects+0x192/0x200 [nvme_core]\nnvme_cmd_allowed+0x7e/0x1b0 [nvme_core]\nnvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core]\nnvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]\nMove the log cache to the subsystem, with one entry per command set. Both\ncontrollers and namespace heads hold subsystem references, keeping their\nlog pointers valid until subsystem release.", "A flaw was found in the Linux kernel's Non-Volatile Memory Express (NVMe) driver. A local attacker can cause a denial of service (DoS) or potentially escalate privileges by exploiting a use-after-free flaw. This issue occurs when an input/output (I/O) passthrough command is sent through a multipath storage device after the initial controller path has been removed, causing the kernel to access already-freed memory."], "name": "CVE-2026-98814", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Fix deferred", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-18T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98814\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98814\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98814.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[be93e87e780253780df9bb6ecc9bc1199b0d94c3,351d1c47e45b2b35780d0548b1012d7242ba298d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[be93e87e780253780df9bb6ecc9bc1199b0d94c3,72ece656abd4de8645a421fb482d7a11e6533a45)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.9"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.9)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.10,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-18T21:30:14.254104+00:00", "updated": "2026-10-24T01:45:17.367074+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-416", "CWE-825"]}