CVE-2026-98355

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98355", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.344Z", "datePublished": "2026-10-06T08:46:42.583Z", "dateUpdated": "2026-10-19T09:18:05.923Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:18:05.923Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs: guard against null kobj name\n\nIn the client, if `init_path()` errors, the callee tries to clean up\nwith `rtrs_clt_close_conns()`. However, this can lead to calling the\nevent tracing code with `clt_path->kobj->name` being `NULL` and thus\ncausing a null pointer dereference when trying to copy from it.\n\nThis just adds a guard to check that the name is not `NULL` before\ncopying from it. The server appears to have a similar pattern."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h", "drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"], "versions": [{"version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d", "lessThan": "f79cf42ff23f9120246cd6740eaa26f59c632a4a", "status": "affected", "versionType": "git"}, {"version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d", "lessThan": "99c24a8968ebef0573825b5cb89d5985d51635b9", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h", "drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a"}, {"url": "https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}], "title": "RDMA/rtrs: guard against null kobj name", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h", "drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "f79cf42ff23f9120246cd6740eaa26f59c632a4a", "status": "affected", "version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d", "versionType": "git"}, {"lessThan": "99c24a8968ebef0573825b5cb89d5985d51635b9", "status": "affected", "version": "5a93929d9f9a1d82946ddd49e260b6dd1756ad6d", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h", "drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rtrs: guard against null kobj name\n\nIn the client, if `init_path()` errors, the callee tries to clean up\nwith `rtrs_clt_close_conns()`. However, this can lead to calling the\nevent tracing code with `clt_path->kobj->name` being `NULL` and thus\ncausing a null pointer dereference when trying to copy from it.\n\nThis just adds a guard to check that the name is not `NULL` before\ncopying from it. The server appears to have a similar pattern."}], "id": "CVE-2026-98355", "lastModified": "2026-10-19T10:18:38.210", "metrics": {}, "published": "2026-10-06T09:18:29.040", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/rtrs: guard against null kobj name", "id": "2546389", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546389"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-476", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/rtrs: guard against null kobj name\nIn the client, if `init_path()` errors, the callee tries to clean up\nwith `rtrs_clt_close_conns()`. However, this can lead to calling the\nevent tracing code with `clt_path->kobj->name` being `NULL` and thus\ncausing a null pointer dereference when trying to copy from it.\nThis just adds a guard to check that the name is not `NULL` before\ncopying from it. The server appears to have a similar pattern.", "A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. When connection path initialization fails in the RDMA Transport (RTRS) driver, error cleanup routines invoke event tracing before the associated object name is set. This issue leads to a null pointer dereference, allowing a user or network peer capable of triggering connection errors to crash the system, resulting in a Denial of Service (DoS)."], "name": "CVE-2026-98355", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98355\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98355\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98355.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5a93929d9f9a1d82946ddd49e260b6dd1756ad6d,f79cf42ff23f9120246cd6740eaa26f59c632a4a)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[5a93929d9f9a1d82946ddd49e260b6dd1756ad6d,99c24a8968ebef0573825b5cb89d5985d51635b9)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.1"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.1)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.8,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc4,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-06T14:00:20.949070+00:00", "updated": "2026-10-07T14:15:15.959790+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"], "weaknesses": ["CWE-476"]}