This vulnerability arises in the Linux kernel NVMe subsystem when an I/O passthrough command is issued to a multipath namespace head after its controller path has been removed. The kernel’s command effects log holds stale pointers, leading to a use‑after‑free detected by KASAN. Accessing freed memory can corrupt kernel state, which an attacker could exploit to execute arbitrary code with kernel privileges. The description only indicates a kernel memory corruption; the severity depends on the attacker’s ability to control the command flow. Based solely on the provided information, the impact is material to users who can issue NVMe passthrough commands, potentially allowing privilege escalation on the affected host.

All Linux kernel distributions that include the affected NVMe driver code prior to the patch are susceptible. The specific controller or namespace definitions are not enumerated, and no API versioning is given, implying the issue could exist across multiple kernel releases until the fix is applied. Updating to a kernel version that contains the nvme_command_effects log cache fix removes the vulnerability.

The CVSS score is 4.4, and the EPSS score is below 1%, indicating a moderate severity but low probability of exploitation. The vulnerability is not listed in CISA KEV. The likely attack vector is a local user with permission to send NVMe commands to a multipath namespace. The defect requires that the controller path that first created the head has been removed before a passthrough command is issued, leading to a use‑after‑free. Exploitation would corrupt kernel memory and could allow an attacker to execute arbitrary code with kernel privileges. Although publicly available exploit code is not documented, the combination of kernel memory corruption and potential privilege escalation warrants prompt mitigation.