HighFix available
nvme-rdma: fix -EIO cleanup order in queue_rq
Type: advisorySources: OSV
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
- Products
- Kernel
- Affected versions
- Not specified
- Fixed versions
- 5.15.222, 6.1.189, 6.12.111, 6.18.53, 6.6.158, 7.2.7
- CVEs
- CVE-2026-98154
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 5 Nov 2026, 00:54 UTC · Revision 1
Source evidence
nvme-rdma: fix -EIO cleanup order in queue_rq
core-osv · Original sourcePublished 25 Sept 2026, 10:36 UTC
In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.
osv:CVE-2026-98154
Kernel
Fixed versions: 5.15.222, 6.1.189, 6.6.158, 6.12.111, 6.18.53, 7.2.7
Complete source record
{
"id": "d5442b0a2670c86b6ce9cd838ce9a4b3ed3dc300986cda69d5f39d0e0d85072d",
"url": "https://osv.dev/vulnerability/CVE-2026-98154",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "nvme-rdma: fix -EIO cleanup order in queue_rq",
"summary": "In the Linux kernel, the following vulnerability has been resolved: nvme-rdma: fix -EIO cleanup order in queue_rq On -EIO, the RDMA queue_rq path reports a host path error and then still cleans up the command and unmaps the SQE DMA. The path error helper completes the request, so that is double cleanup and DMA unmap after the request is already complete. Unmap the SQE first, then report the host path error. Skip the outer command cleanup on that path.",
"evidence": "osv:CVE-2026-98154",
"products": [
{
"name": {
"value": "Kernel",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "5.15.222",
"evidence": "/affected/1/ranges"
},
{
"value": "6.1.189",
"evidence": "/affected/1/ranges"
},
{
"value": "6.6.158",
"evidence": "/affected/1/ranges"
},
{
"value": "6.12.111",
"evidence": "/affected/1/ranges"
},
{
"value": "6.18.53",
"evidence": "/affected/1/ranges"
},
{
"value": "7.2.7",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
}
],
"severity": "high",
"structured": {
"id": "CVE-2026-98154",
"aliases": [
"CVE-2026-98154"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"type": "GIT",
"events": [
{
"introduced": "62eca39722fd997e3621fc903229917b9f0fb271"
},
{
"fixed": "ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb"
},
{
"fixed": "c2459519b39587c9c27d6b8a8cf516fee10fce66"
},
{
"fixed": "965804b20c0f02c1a6cf4b69c0498a79e56f97fe"
},
{
"fixed": "a41e7fc8d244d9cfc6273051aed85b67adedbb89"
},
{
"fixed": "cf3e706963ffbd3ee2568fa0d08ab016f0575ea8"
},
{
"fixed": "171b993a4aed9889159df4815b6a6ba141e61975"
},
{
"fixed": "d61828199c6cb4b76d48403c77023cd4bb9d09fc"
}
]
}
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98154.json"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.12.0"
},
{
"fixed": "5.15.222"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "5.16.0"
},
{
"fixed": "6.1.189"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.2.0"
},
{
"fixed": "6.6.158"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.7.0"
},
{
"fixed": "6.12.111"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.13.0"
},
{
"fixed": "6.18.53"
}
]
},
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "6.19.0"
},
{
"fixed": "7.2.7"
}
]
}
],
"package": {
"name": "Kernel",
"ecosystem": "Linux"
},
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-98154.json"
}
}
],
"modified": "2026-10-28T02:30:40.937498269Z",
"provider": "osv",
"references": [
"https://git.kernel.org/stable/c/171b993a4aed9889159df4815b6a6ba141e61975",
"https://git.kernel.org/stable/c/965804b20c0f02c1a6cf4b69c0498a79e56f97fe",
"https://git.kernel.org/stable/c/a41e7fc8d244d9cfc6273051aed85b67adedbb89",
"https://git.kernel.org/stable/c/c2459519b39587c9c27d6b8a8cf516fee10fce66",
"https://git.kernel.org/stable/c/ccf37fff526cab2d0e6ff2aaf35947f3cf62e5bb",
"https://git.kernel.org/stable/c/cf3e706963ffbd3ee2568fa0d08ab016f0575ea8",
"https://git.kernel.org/stable/c/d61828199c6cb4b76d48403c77023cd4bb9d09fc",
"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98154.json",
"https://nvd.nist.gov/vuln/detail/CVE-2026-98154",
"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
],
"provider_metadata": {
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/98xxx/CVE-2026-98154.json"
}
},
"related_cves": [
{
"value": "CVE-2026-98154",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 508727,
"published_at": "2026-09-25T10:36:25.215+00:00"
}