CVE-2026-98356

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/bnxt_re: check create_singlethread_workqueue() in DCB setup bnxt_re_init_dcb_wq() ignores a failed allocation. The async DCB handler later calls queue_work() on the NULL pointer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-11-08

AI Q&A

2026-10-06

EPSS Evaluated

2026-11-07

NVD

CVE-2026-98356

EUVD

EUVD-2026-93341

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	51dc5312dcd929efea7647c0c0e75afa461531b5
Linux	Linux	51dc5312dcd929efea7647c0c0e75afa461531b5
Linux	Linux	51dc5312dcd929efea7647c0c0e75afa461531b5
Linux	Linux	6.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability is in the Linux kernel's RDMA driver for Broadcom NetXtreme-C/E devices (bnxt_re). It occurs when the driver fails to check if a workqueue was successfully created during DCB (Data Center Bridging) setup. If the workqueue allocation fails, the driver later attempts to use this NULL pointer, leading to a potential system crash or undefined behavior.

Detection Guidance

This vulnerability involves a NULL pointer dereference in the bnxt_re driver's DCB setup due to ignored workqueue allocation failure. Detection requires checking for kernel logs indicating crashes or NULL pointer dereferences in RDMA/bnxt_re modules. Monitor system logs for oops or kernel panic messages related to bnxt_re or DCB functionality.

Impact Analysis

If exploited, this vulnerability could cause a kernel panic or system instability on affected Linux systems using the bnxt_re driver. This may result in denial of service, data corruption, or unauthorized access depending on the attacker's capabilities and system configuration.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it involves a NULL pointer dereference in the Linux kernel's RDMA/bnxt_re driver due to a failed workqueue allocation. Compliance impacts would depend on system-specific configurations and compensating controls rather than the vulnerability itself.

Mitigation Strategies

Update the Linux kernel to the latest patched version to resolve the RDMA/bnxt_re DCB setup issue where create_singlethread_workqueue() allocation failure is ignored.

Hi! I’m here to help you understand CVE-2026-98356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70

EPSS Chart

Security Radar

News mentioning this vulnerability

Loading related security news...