CVE-2026-98358 in Linux
Summary
by MITRE • 10/06/2026
In the Linux kernel, the following vulnerability has been resolved:
IB/iser: reject a remote invalidation of an unregistered direction
A write command whose data is sent entirely as immediate data is not registered. iser_reg_mem_fastreg() takes the DMA key path and leaves rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has
already set dir[ISER_DIR_OUT].
iser_check_remote_inv() looks at dir[] alone and hands the descriptor to
iser_inv_desc(), which reads desc->sig_protected. A target that answers such a command with IB_WR_SEND_WITH_INV faults the initiator. Leaving those commands unregistered is deliberate.
The same function already terminates the connection when a target sends a remote invalidation the initiator did not ask for. A target that invalidates a direction that was never registered is in the same class, so give it the same answer.
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]
CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy) Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: rxe_wq do_work RIP: 0010:iser_task_rsp+0x6d6/0xec0 Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 <0f> b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04 RSP: 0018:ffff88811b008db8 EFLAGS: 00010202 RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848 RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020 RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0 R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800 R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000 FS: 0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0 PKRU: 55555554 Call Trace: <IRQ> __ib_process_cq+0xe1/0x390 ib_poll_handler+0x6e/0x200 irq_poll_softirq+0x1df/0x480 ? clockevents_program_event+0x2ba/0x860 ? __pfx_irq_poll_softirq+0x10/0x10 handle_softirqs+0x18e/0x590 ? __pfx_handle_softirqs+0x10/0x10 ? __hrtimer_rearm_deferred+0x156/0x450 do_softirq+0x3b/0x60 </IRQ> <TASK> __local_bh_enable_ip+0x61/0x70 __alloc_skb+0x732/0x890 ? _raw_spin_lock_irqsave+0x85/0xe0 ? __pfx___alloc_skb+0x10/0x10 ? _raw_read_unlock_irqrestore+0x16/0x50 rxe_init_packet+0x16b/0x4f0 prepare_ack_packet+0xb8/0x830 rxe_receiver+0x499/0x9980 ? __pfx_rxe_receiver+0x10/0x10 ? rxe_completer+0x29e5/0x38c0 ? hrtimer_start_range_ns_common+0x75f/0x1730 ? hrtimer_start_range_ns+0xa6/0x2c0 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? __pfx_rxe_receiver+0x10/0x10 do_work+0x144/0x470 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30 </TASK> Modules linked in: ---[ end trace 0000000000000000 ]---
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/06/2026
The Linux kernel's InfiniBand iSER (SCSI over RDMA) driver contains a critical logic flaw that allows remote attackers to trigger a denial of service condition through improper handling of memory registration states during command processing. The vulnerability stems from an inconsistency in how the driver tracks data directions for write commands where all payload data is transmitted as immediate data, meaning no actual buffer registration occurs on the outbound direction. When such a command is processed, the function iser_reg_mem_fastreg correctly bypasses DMA key allocation and leaves the rdma_reg descriptor at ISER_DIR_OUT set to NULL. However, the subsequent call to iser_dma_map_task_data incorrectly marks the direction as registered by setting dir[ISER_DIR_OUT] to true. This creates a state mismatch where the driver believes outbound data was registered when it actually was not.
This discrepancy becomes exploitable when an RDMA target responds with an invalidation request for that specific command. The function iser_check_remote_inv relies solely on the direction flags rather than verifying actual registration status or descriptor validity. Consequently, it passes a NULL pointer to iser_inv_desc, which attempts to dereference desc->sig_protected without checking if desc itself is valid. This null-pointer dereference results in a general protection fault within the kernel space, specifically crashing the system via an invalid memory access at address 0xdffffc0000000004. The crash occurs during softirq processing of completion queue events, affecting worker threads responsible for handling RDMA operations and effectively halting all iSER-based storage connectivity on the affected host.
From a security perspective, this vulnerability represents a classic case of improper input validation leading to resource management errors. It aligns with CWE-476, which describes null pointer dereference vulnerabilities that occur when software fails to check for NULL before using pointers. In the context of network-facing subsystems like iSER, such flaws can be triggered remotely by malicious or misconfigured RDMA targets, classifying this under MITRE ATT&CK technique T1498, Network Denial of Service. The attacker does not need authentication if they are on the same fabric and possess valid connection parameters, making it a significant risk in enterprise storage environments where trust boundaries between initiators and targets may be loosely defined or compromised.
The operational impact includes complete system instability due to kernel panics, leading to unplanned downtime for critical services relying on iSER storage paths. Since the crash occurs during interrupt handling of RDMA completions, it can also lead to data corruption if write operations were partially completed before the fault occurred. Furthermore, repeated exploitation attempts could degrade system performance by consuming CPU cycles in error recovery routines or causing frequent reboots that disrupt service level agreements associated with high-availability storage architectures.
Mitigation strategies should prioritize applying kernel updates released after this fix was merged into mainline Linux distributions. Administrators operating iSER environments must ensure their kernels are patched to version 7.2 and later, where the logic in iser_check_remote_inv has been corrected to validate registration status before proceeding with invalidation handling. Additionally, network segmentation policies should restrict RDMA traffic to trusted initiators only, reducing exposure to potentially malicious targets. Monitoring logs for general protection faults related to iSER components can help detect attempted exploitation or misconfigurations early, allowing administrators to isolate affected nodes and prevent cascading failures across the storage fabric.