CVE-2026-98815

In the Linux kernel, the following vulnerability has been resolved:

nvme: fix cdev lifetime

Sashiko bot reported a potential problem for the cdev lifetime in [0]

Currently the NS head .open and .release file operations methods take and put a reference to the nvme ns head to ensure that this structure does not disappear while we open fds for that cdev.

In multipath mode, when we teardown the NS head, we call nvme cdev del() -> cdev device del() -> cdev del(). However after cdev del() returns, cdevs already open will remain and their fops will still be callable. As such, we can still reference the cdev after the nvme ns head reference count drops to 0 (and is freed).

This can be shown with an application which delays between opening the cdev and issuing the ioctl while the NS head is being torn down:

[ 21.221718] nvme nvme1: Removing ctrl: NQN "nvme-test-target" [ 21.274609] nvme nvme2: Removing ctrl: NQN "nvme-test-target"

[ 26.549285] ================================================================== [ 26.550841] BUG: KASAN: slab-use-after-free in cdev put.part.0+0x3d/0x40 [ 26.552352] Read of size 8 at addr ffff88811e7fa170 by task ioctl file/237 [ 26.553805] [ 26.554227] CPU: 3 UID: 0 PID: 237 Comm: ioctl file Not tainted 7.2.0-rc1-00004-g6852a10e32d4 #921 PREEMPT(lazy) [ 26.554236] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 26.554241] Call Trace: [ 26.554245] [ 26.554248] dump stack lvl+0x68/0xa0 [ 26.554266] print report+0x10d/0x5d0 [ 26.554276] ? virt addr valid+0x21d/0x3f0 [ 26.554287] ? cdev put.part.0+0x3d/0x40 [ 26.554292] kasan report+0x96/0xd0 [ 26.554300] ? cdev put.part.0+0x3d/0x40 [ 26.554307] cdev put.part.0+0x3d/0x40 [ 26.554313] fput+0x7bc/0xa70 [ 26.554322] fput close sync+0xd8/0x190 [ 26.554328] ? pfx fput close sync+0x10/0x10 [ 26.554337] x64 sys close+0x79/0xd0 [ 26.554344] do syscall 64+0x117/0x6b0 [ 26.554351] entry SYSCALL 64 after hwframe+0x77/0x7f [ 26.554358] RIP: 0033:0x7f938c067727 [ 26.554364] Code: 48 89 fa 4c 89 df e8 28 ad 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5bf [ 26.554369] RSP: 002b:00007fff49f05980 EFLAGS: 00000202 ORIG RAX: 0000000000000003 [ 26.554376] RAX: ffffffffffffffda RBX: 00007f938bfd7780 RCX: 00007f938c067727 [ 26.554380] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000003 [ 26.554383] RBP: 00007fff49f05a10 R08: 0000000000000000 R09: 0000000000000000 [ 26.554386] R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 [ 26.554389] R13: 00007fff49f05b40 R14: 00007f938c207000 R15: 000055c148471d78 [ 26.554397] [ 26.554399] [ 26.575612] Allocated by task 100: [ 26.575871] kasan save stack+0x24/0x50 [ 26.576157] kasan save track+0x14/0x30 [ 26.576418] kasan kmalloc+0x7f/0x90 [ 26.576668] kmalloc noprof+0x281/0x6c0 [ 26.576938] nvme alloc ns+0x7f7/0x3170 [ 26.577206] nvme scan ns+0x508/0x880 [ 26.577449] async run entry fn+0x8c/0x350 [ 26.577723] process scheduled works+0xb6f/0x1a00 [ 26.578034] worker thread+0x4ad/0xb40 [ 26.578283] kthread+0x34f/0x450 [ 26.578501] ret from fork+0x563/0x800 [ 26.578752] ret from fork asm+0x1a/0x30 [ 26.579012] [ 26.579124] Freed by task 237: [ 26.579335] kasan save stack+0x24/0x50 [ 26.579596] kasan save track+0x14/0x30 [ 26.579855] kasan save free info+0x3a/0x60 [ 26.580131] kasan slab free+0x43/0x70 [ 26.580388] kfree+0x321/0x500 [ 26.580591] nvme ns head chr release+0x39/0x50 [ 26.580883] fput+0x352/0xa70 [ 26.581095] fput close sync+0xd8/0x190 [ 26.581350] x64 sys close+0x79/0xd0 [ 26.581595] do syscall 64+0x117/0x6b0 [ 26.581842] entry SYSCAL ---truncated---