In the Linux kernel, the following vulnerability has been resolved: nvme: fix cdev lifetime Sashiko bot reported a potential problem for the cdev… (CVE-2026-98815)

The vulnerability involves improper management of the nvme_ns_head reference count in the Linux kernel NVMe driver. When tearing down the namespace head in multipath mode, the cdev device is deleted, but existing open file descriptors still reference the cdev operations. This results in use-after-free conditions when those file operations are invoked after the nvme_ns_head has been freed. The issue was demonstrated by a delayed ioctl call on an open cdev during teardown, triggering a KASAN slab-use-after-free error. The fix addresses the lifetime management of the cdev to prevent referencing freed memory.

The vulnerability can cause kernel memory corruption through use-after-free, leading to system instability or crashes. There is no evidence of known exploits in the wild. The impact is limited to systems using the NVMe driver in multipath mode where the namespace head is torn down while file descriptors remain open.

A fix has been applied to the Linux kernel to properly manage the lifetime of the NVMe cdev and prevent use-after-free conditions. Users should update to a Linux kernel version that includes this fix. No additional mitigation steps are indicated by the vendor advisory.