CVE-2026-98355

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if `init_path()` errors, the callee tries to clean up with `rtrs_clt_close_conns()`. However, this can lead to calling the event tracing code with `clt_path->kobj->name` being `NULL` and thus causing a null pointer dereference when trying to copy from it. This just adds a guard to check that the name is not `NULL` before copying from it. The server appears to have a similar pattern.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98355

EUVD

EUVD-2026-93340

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	5a93929d9f9a1d82946ddd49e260b6dd1756ad6d
Linux	Linux	5a93929d9f9a1d82946ddd49e260b6dd1756ad6d
Linux	Linux	6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a null pointer dereference vulnerability in the Linux kernel's RDMA subsystem. It occurs when the client's init_path() function fails and cleanup code tries to access a null kobj name pointer during event tracing. The fix adds a check to ensure the name is not null before copying it.

Detection Guidance

This vulnerability involves a null pointer dereference in the Linux kernel's RDMA/rtrs module. Detection requires checking kernel logs for crashes or errors related to rtrs_clt_close_conns or rtrs_srv_close_conns. Monitor for kernel oops messages or tracepoint errors involving NULL kobj names.

Impact Analysis

This vulnerability could cause a system crash or kernel panic if exploited, leading to denial of service. It may allow local attackers to trigger kernel faults through RDMA operations.

Compliance Impact

This vulnerability involves a null pointer dereference in the Linux kernel's RDMA subsystem, specifically when handling kobj names during error cleanup. It does not directly relate to data privacy, access control, or audit logging, which are key concerns for GDPR and HIPAA. Therefore, it is unlikely to impact compliance with these standards.

Mitigation Strategies

Apply the latest Linux kernel security patches that address this issue. If immediate patching is not possible, disable RDMA/rtrs functionality temporarily by unloading the rtrs module or restricting its use via kernel parameters until the fix is applied.

Hi! I’m here to help you understand CVE-2026-98355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70