CVE-2026-98358: Linux kernel · IB/iser: reject a remote invalidation of an unregistered direction
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in d85f0f0a7c85756fc992c70d869706f19dac9259 : patch Linux kernel soon.
Data as of 26 Oct 2026, 17:16 UTC
Rated High by Threat Radar's AI analysis · CVSS not yet scored by NVD
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in d85f0f0a7c85756fc992c70d869706f19dac9259, ceecf3f9c322fc6937a66682942a26ad13a34a07, b9e37452915feaa8422af87dea5d0c16a7d1ff13 +5
Exploitation evidence
Disclosed: evidence found.
CVE published 6 Oct 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade to a fixed release listed under Affected software.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
AI-suggested
A fix has been implemented in the Linux kernel to reject remote invalidations of unregistered directions by terminating the connection. Users should update to a Linux kernel version that includes the fix identified by the listed commit hashes. Patch status is confirmed by fixed versions in the Linux kernel source. No additional mitigation is required beyond applying the official fix.
Description
CVE-2026-98358 is a vulnerability in the Linux kernel's IB/iser subsystem where a remote invalidation of an unregistered direction can cause a general protection fault. The issue arises because certain write commands sent entirely as immediate data are not registered, leading to a null pointer dereference when the kernel attempts to process a remote invalidation for that unregistered direction. This can cause a kernel crash (general protection fault).
References
- git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a (opens in a new tab)
- git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13 (opens in a new tab)
- git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427 (opens in a new tab)
- git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0 (opens in a new tab)
- git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad (opens in a new tab)
- git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41 (opens in a new tab)
- git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07 (opens in a new tab)
- git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259 (opens in a new tab)