Description
In the Linux kernel, the following vulnerability has been resolved:
nvme: fix command effects log lifetime for multipath heads
KASAN reported a use-after-free when an I/O passthrough command was sent through a multipath namespace head after the controller path that first created the head had been removed:
BUG: KASAN: slab-use-after-free in nvme_command_effects+0x192/0x200 [nvme_core] Read of size 4 at addr ffff888141b14400 by task nvme/19811 nvme_command_effects+0x192/0x200 [nvme_core] nvme_cmd_allowed+0x7e/0x1b0 [nvme_core] nvme_user_cmd.constprop.0+0x1b5/0x450 [nvme_core] nvme_ns_head_chr_ioctl+0xf4/0x2a0 [nvme_core]
Move the log cache to the subsystem, with one entry per command set. Both controllers and namespace heads hold subsystem references, keeping their log pointers valid until subsystem release.
Metrics
No CVSS score has been published yet.
Affected software
Source: the vendor's advisory (CNA). NVD analysis pending.
No affected versions have been published.
Timeline
- Published
- Oct 18, 2026
- Last modified
- Oct 19, 2026
- NVD status
- Received