CVE-2026-98355: Linux kernel · RDMA/rtrs: guard against null kobj name
Affects Linux kernelSource CVE Database V5
Not known to be exploited : upgrade to f79cf42ff23f9120246cd6740eaa26f59c632a4a or 99c24a8968ebef0573825b5cb89d5985d51635b9 when convenient.
Data as of 26 Oct 2026, 13:47 UTC
Rated Medium by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in f79cf42ff23f9120246cd6740eaa26f59c632a4a, 99c24a8968ebef0573825b5cb89d5985d51635b9
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade Linux kernel to f79cf42ff23f9120246cd6740eaa26f59c632a4a or 99c24a8968ebef0573825b5cb89d5985d51635b9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available in the Linux kernel as indicated by the fixed commit versions. Users should update to the fixed kernel versions containing commits f79cf42ff23f9120246cd6740eaa26f59c632a4a or 99c24a8968ebef0573825b5cb89d5985d51635b9 to remediate this issue.
Description
A null pointer dereference vulnerability was identified in the Linux kernel's RDMA/rtrs client code. If the init_path() function fails, cleanup code may invoke event tracing with a null kobj name, causing a null pointer dereference. The issue was fixed by adding a guard to check for a null kobj name before copying from it. Similar patterns exist on the server side. The vulnerability affects Linux kernel version 6.1.