{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/mad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4617c9a856188674dddb0ca66979746d07688579",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "8e2036fb47a5b152d53eadbd35abf311bd34cc7f",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "bad289e42f512646a988f278f536d21547df73f1",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "752b30e9d339008e5ce7eed412e9446078916129",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "39c4ea72a40503e102ae07e6776005f96ca078a6",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "5091e25ec503f7fc02723ca435226467b68caac7",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "c0d8df85db146d6275e226cb950023be69dd6c77",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            },
            {
              "lessThan": "3476c28c9addfa253f505e6bd87f1f5598b961d0",
              "status": "affected",
              "version": "47a2b338fe63200d716d2e24131cdb49f17c77da",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/mad.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.13"
            },
            {
              "lessThan": "4.13",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.13",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/mad: Fix receive buffer leak when PKey enforcement fails\n\nib_mad_complete_recv() initializes mad_recv_wc-\u003ermpp_list and then runs\nib_mad_enforce_security() before linking recv_buf onto that list.  On\nfailure it calls ib_free_recv_mad(), which only walks rmpp_list and frees\nthe ib_mad_private of every buffer found there.  As the list is still\nempty at that point, nothing is freed at all.\n\nThe caller cannot clean up either: ib_mad_recv_done() sets recv to NULL\nright after ib_mad_complete_recv() returns, assuming the MAD layer took\nownership of the buffer.  Every MAD that fails the PKey check therefore\nleaks one ib_mad_private (about 300 bytes per IB port MAD, ~2K for OPA),\nand a remote node can trigger this repeatedly by sending MADs with a\nwrong PKey.\n\nLink recv_buf onto rmpp_list right after the list is initialized, so the\nerror path has something to free."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:04.973Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4617c9a856188674dddb0ca66979746d07688579"
        },
        {
          "url": "https://git.kernel.org/stable/c/8e2036fb47a5b152d53eadbd35abf311bd34cc7f"
        },
        {
          "url": "https://git.kernel.org/stable/c/bad289e42f512646a988f278f536d21547df73f1"
        },
        {
          "url": "https://git.kernel.org/stable/c/752b30e9d339008e5ce7eed412e9446078916129"
        },
        {
          "url": "https://git.kernel.org/stable/c/39c4ea72a40503e102ae07e6776005f96ca078a6"
        },
        {
          "url": "https://git.kernel.org/stable/c/5091e25ec503f7fc02723ca435226467b68caac7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c0d8df85db146d6275e226cb950023be69dd6c77"
        },
        {
          "url": "https://git.kernel.org/stable/c/3476c28c9addfa253f505e6bd87f1f5598b961d0"
        }
      ],
      "title": "RDMA/mad: Fix receive buffer leak when PKey enforcement fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98354",
    "datePublished": "2026-10-06T08:46:41.768Z",
    "dateReserved": "2026-09-25T10:25:14.343Z",
    "dateUpdated": "2026-10-19T09:18:04.973Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/isert/ib_isert.c",
            "drivers/infiniband/ulp/isert/ib_isert.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "f5613acbe2e346d5c466ef0bd264fca936b69f82",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "ccdb1523f12bc8a9646de65055d1aafed9e9bcc6",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "0e230917670c6e6fe3243abfa11299fcbe05b1f4",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "505b242d9351690d1385bbe508ab4666f60363ce",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "7edb8a88d6c76237c8b4435765bee1009e26a50a",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "b96b8b3e41c308f606ffd10cfef1a7b9f97414cd",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "7908fbc597a694bbd99bfb59ece73bc3daded68e",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            },
            {
              "lessThan": "a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f",
              "status": "affected",
              "version": "b8d26b3be8b33682cf163274ed07479a70554633",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/isert/ib_isert.c",
            "drivers/infiniband/ulp/isert/ib_isert.h"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.10"
            },
            {
              "lessThan": "3.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "3.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/isert: wait for deferred control PDU completions before releasing the connection\n\nisert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and\nISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns.  The work\nitem then runs isert_completion_put() -\u003e isert_put_cmd(), which reads\nisert_conn-\u003econn and takes conn-\u003ecmd_lock.\n\nNothing orders that work item against teardown.  isert_wait_conn() queues\nisert_release_work, which frees isert_conn, and iscsit_close_connection()\nfrees the iscsit_conn right after it returns, so the queued work can run\nagainst freed memory.\n\nCount the deferred control PDU completions per connection and let\nisert_wait_conn() wait for them before the release work is queued.\n\nISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs\niscsit_logout_post_handler(), which ends up waiting for\nconn-\u003econn_wait_comp, and that completion is only sent by\niscsit_close_connection() after it has called iscsit_wait_conn().\nWaiting for it here would deadlock.  Its wait stays the existing\nisert_wait4logout().\n\nThe splat below is from a kernel with tracing printk()s and an msleep(200)\ninjected into isert_do_control_comp() to widen the window:\n\n  BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620\n  Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182\n\n  CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G    B               7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy)\n  Tainted: [B]=BAD_PAGE\n  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: isert_comp_wq isert_do_control_comp\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl+0x53/0x70\n   print_report+0xd0/0x630\n   ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n   ? _raw_spin_unlock_irqrestore+0x3e/0x70\n   ? isert_put_cmd+0x53d/0x620\n   kasan_report+0xce/0x100\n   ? isert_put_cmd+0x53d/0x620\n   isert_put_cmd+0x53d/0x620\n   ? isert_completion_put+0x305/0x330\n   ? isert_do_control_comp+0x2ef/0x310\n   process_one_work+0x633/0x1030\n   ? assign_work+0x11d/0x370\n   worker_thread+0x45b/0xd10\n   ? __pfx_worker_thread+0x10/0x10\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c6/0x3b0\n   ? recalc_sigpending+0x15c/0x1e0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x36e/0x5a0\n   ? __pfx_ret_from_fork+0x10/0x10\n   ? __switch_to+0x572/0xdd0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n\n  Allocated by task 48:\n   kasan_save_stack+0x33/0x60\n   kasan_save_track+0x14/0x30\n   __kasan_kmalloc+0x8f/0xa0\n   __kmalloc_cache_noprof+0x158/0x370\n   isert_cma_handler+0x1e3/0x2ae0\n   cma_cm_event_handler+0x3e/0x240\n   cma_ib_req_handler+0x17d9/0x4490\n   cm_process_work+0x41/0x330\n   cm_work_handler+0x5727/0xc160\n   process_one_work+0x633/0x1030\n   worker_thread+0x45b/0xd10\n   kthread+0x2c6/0x3b0\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30\n\n  Freed by task 184:\n   kasan_save_stack+0x33/0x60\n   kasan_save_track+0x14/0x30\n   kasan_save_free_info+0x3b/0x60\n   __kasan_slab_free+0x43/0x70\n   kfree+0x121/0x380\n   iscsit_close_connection+0x7cf/0x1e60\n   iscsit_take_action_for_connection_exit+0x1b6/0x360\n   iscsi_target_tx_thread+0x472/0x690\n   kthread+0x2c6/0x3b0\n   ret_from_fork+0x36e/0x5a0\n   ret_from_fork_asm+0x1a/0x30"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The iSER initiator triggers it remotely over RDMA (iWARP/RoCEv2 are IP-routable). Its iSCSI Text Request (or a TMF or a malformed PDU that draws a Reject) makes isert_send_done() queue isert_do_control_comp(); an RDMA CM disconnect from the same initiator then starts teardown via iscsit_close_connection().\nAC:H - The attacker sends both the request and the disconnect, but the free only wins if the already-queued isert_comp_wq work stays delayed through ib_drain_qp, isert_wait4cmds and the release work. The attacker can\u0027t control that scheduling; the reporter needed an injected msleep(200) to reproduce it.\nPR:N - The attacker only needs a full-feature iSCSI session, and LIO allows login with AuthMethod=None, where the initiator IQN is merely asserted. No credentials are checked before the Text/TMF/Reject paths that queue the deferred completion.\nUI:N - The initiator triggers the response PDU and the connection teardown entirely through its own iSCSI PDUs and RDMA CM disconnect; no action by a target administrator is needed.\nS:U - The use-after-free is in the target host\u0027s own kernel memory (isert_conn and iscsit_conn), so the impact stays within the same kernel security authority.\nC:H - isert_put_cmd() dereferences the freed isert_conn-\u003econn and reads the freed iscsit_conn and cmd structures. Reclaiming those slab objects lets attacker-shaped data steer kernel pointer reads.\nI:H - On the freed iscsit_conn, isert_put_cmd() takes spin_lock_bh(\u0026conn-\u003ecmd_lock), runs list_del_init(\u0026cmd-\u003ei_conn_node) and calls iscsit_release_cmd()/transport_generic_free_cmd(). These are writes and frees through freed memory, which can corrupt the heap.\nA:H - The isert_comp_wq worker hits a slab use-after-free in isert_put_cmd() (KASAN splat in the fix commit), which on production kernels can crash or oops the iSCSI target host."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:07.886Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82"
        },
        {
          "url": "https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6"
        },
        {
          "url": "https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4"
        },
        {
          "url": "https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce"
        },
        {
          "url": "https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd"
        },
        {
          "url": "https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f"
        }
      ],
      "title": "IB/isert: wait for deferred control PDU completions before releasing the connection",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98357",
    "datePublished": "2026-10-06T08:46:44.216Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-19T09:18:07.886Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/iser/iser_initiator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "198e4db9add54a50cce60a5d80b8f0ee5456b65a",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "b9e37452915feaa8422af87dea5d0c16a7d1ff13",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "19ddd4af7fce9200e70882f622011e9dd130f427",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "9d145a2d8d6f8f2cc460b80df41870819048f2a0",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "b4d278c91209931199db9c0836dc2e21a7593dad",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "6ed3ebaff3345837f0528d85bd39ce573c7b9a41",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "ceecf3f9c322fc6937a66682942a26ad13a34a07",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            },
            {
              "lessThan": "d85f0f0a7c85756fc992c70d869706f19dac9259",
              "status": "affected",
              "version": "59caaed7a72a0e3750dfb84636dae6b781559310",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/ulp/iser/iser_initiator.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.5"
            },
            {
              "lessThan": "4.5",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.5",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nIB/iser: reject a remote invalidation of an unregistered direction\n\nA write command whose data is sent entirely as immediate data is not\nregistered.  iser_reg_mem_fastreg() takes the DMA key path and leaves\nrdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has\nalready set dir[ISER_DIR_OUT].\n\niser_check_remote_inv() looks at dir[] alone and hands the descriptor to\niser_inv_desc(), which reads desc-\u003esig_protected.  A target that answers\nsuch a command with IB_WR_SEND_WITH_INV faults the initiator.\nLeaving those commands unregistered is deliberate.\n\nThe same function already terminates the connection when a target sends\na remote invalidation the initiator did not ask for.  A target that\ninvalidates a direction that was never registered is in the same class,\nso give it the same answer.\n\n  Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI\n  KASAN: null-ptr-deref in range [0x0000000000000020-0x0000000000000027]\n  CPU: 0 UID: 0 PID: 40 Comm: kworker/u8:2 Not tainted 7.2.0-rc5-ISERHOST-gf5098b6bae76-dirty #3 PREEMPT(lazy)\n  Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  Workqueue: rxe_wq do_work\n  RIP: 0010:iser_task_rsp+0x6d6/0xec0\n  Code: 48 c1 ea 03 80 3c 02 00 0f 85 ba 06 00 00 48 8b 9b 78 01 00 00 48 b8 00 00 00 00 00 fc ff df 48 8d 7b 20 48 89 fa 48 c1 ea 03 \u003c0f\u003e b6 04 02 84 c0 74 06 0f 8e 76 06 00 00 80 7b 20 00 0f 84 3d 04\n  RSP: 0018:ffff88811b008db8 EFLAGS: 00010202\n  RAX: dffffc0000000000 RBX: 0000000000000000 RCX: 0000000000001848\n  RDX: 0000000000000004 RSI: 1ffff11021587b12 RDI: 0000000000000020\n  RBP: ffff88810adc1ae4 R08: ffff888109b7f860 R09: ffffffff90a922c0\n  R10: ffff88810adc1a1c R11: 000000000000003c R12: ffff888109b7f800\n  R13: ffff88810adc1acc R14: ffff888109b7f820 R15: 0000000000000000\n  FS:  0000000000000000(0000) GS:ffff88818a676000(0000) knlGS:0000000000000000\n  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n  CR2: 00000000005afe2b CR3: 000000010af23005 CR4: 0000000000770ef0\n  PKRU: 55555554\n  Call Trace:\n   \u003cIRQ\u003e\n   __ib_process_cq+0xe1/0x390\n   ib_poll_handler+0x6e/0x200\n   irq_poll_softirq+0x1df/0x480\n   ? clockevents_program_event+0x2ba/0x860\n   ? __pfx_irq_poll_softirq+0x10/0x10\n   handle_softirqs+0x18e/0x590\n   ? __pfx_handle_softirqs+0x10/0x10\n   ? __hrtimer_rearm_deferred+0x156/0x450\n   do_softirq+0x3b/0x60\n   \u003c/IRQ\u003e\n   \u003cTASK\u003e\n   __local_bh_enable_ip+0x61/0x70\n   __alloc_skb+0x732/0x890\n   ? _raw_spin_lock_irqsave+0x85/0xe0\n   ? __pfx___alloc_skb+0x10/0x10\n   ? _raw_read_unlock_irqrestore+0x16/0x50\n   rxe_init_packet+0x16b/0x4f0\n   prepare_ack_packet+0xb8/0x830\n   rxe_receiver+0x499/0x9980\n   ? __pfx_rxe_receiver+0x10/0x10\n   ? rxe_completer+0x29e5/0x38c0\n   ? hrtimer_start_range_ns_common+0x75f/0x1730\n   ? hrtimer_start_range_ns+0xa6/0x2c0\n   ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n   ? __pfx_rxe_receiver+0x10/0x10\n   do_work+0x144/0x470\n   process_one_work+0x633/0x1030\n   ? assign_work+0x11d/0x370\n   worker_thread+0x45b/0xd10\n   ? __pfx_worker_thread+0x10/0x10\n   kthread+0x2c6/0x3b0\n   ? recalc_sigpending+0x15c/0x1e0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork+0x36e/0x5a0\n   ? __pfx_ret_from_fork+0x10/0x10\n   ? __switch_to+0x572/0xdd0\n   ? __pfx_kthread+0x10/0x10\n   ret_from_fork_asm+0x1a/0x30\n   \u003c/TASK\u003e\n  Modules linked in:\n  ---[ end trace 0000000000000000 ]---"
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:08.867Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/198e4db9add54a50cce60a5d80b8f0ee5456b65a"
        },
        {
          "url": "https://git.kernel.org/stable/c/b9e37452915feaa8422af87dea5d0c16a7d1ff13"
        },
        {
          "url": "https://git.kernel.org/stable/c/19ddd4af7fce9200e70882f622011e9dd130f427"
        },
        {
          "url": "https://git.kernel.org/stable/c/9d145a2d8d6f8f2cc460b80df41870819048f2a0"
        },
        {
          "url": "https://git.kernel.org/stable/c/b4d278c91209931199db9c0836dc2e21a7593dad"
        },
        {
          "url": "https://git.kernel.org/stable/c/6ed3ebaff3345837f0528d85bd39ce573c7b9a41"
        },
        {
          "url": "https://git.kernel.org/stable/c/ceecf3f9c322fc6937a66682942a26ad13a34a07"
        },
        {
          "url": "https://git.kernel.org/stable/c/d85f0f0a7c85756fc992c70d869706f19dac9259"
        }
      ],
      "title": "IB/iser: reject a remote invalidation of an unregistered direction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98358",
    "datePublished": "2026-10-06T08:46:45.128Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-19T09:18:08.867Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "be4b44c8b47c67a04c08b1a0aba18006b749ae6a",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "45c60ffc79771bad154f224a05753191cf1b37bc",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "a219459fbd1b2598e63c81a52847eba6c28b72d2",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "5bd42f74ec3b4f4687fb600f367af0828d513b3c",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            },
            {
              "lessThan": "ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5",
              "status": "affected",
              "version": "d41861942fc55c14b6280d9568a0d0112037f065",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/core/verbs.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/core: Reject unregistering netdevs in ib_get_eth_speed\n\nib_device_get_netdev() intentionally returns a referenced net_device even\nwhen it is unregistering, so matching and cleanup callers can still find\nthe association. The reference keeps struct net_device allocated, but does\nnot guarantee that the device remains operational.\n\nib_get_eth_speed() uses the returned device operationally by invoking its\nethtool callback. Although that call is made under RTNL, the function does\nnot verify the registration state first. An asynchronous RDMA port query\ncan therefore call into a netdev after NETDEV_UNREGISTER and ndo_uninit\nhave completed.\n\nCheck for NETREG_REGISTERED while holding RTNL and return -ENODEV for a\ndevice which is being unregistered. Keeping RTNL across the check and the\nethtool operation prevents unregister from starting between them.\n\nKeep the speed fallback and warning under RTNL as well, so the warning can\nsafely read netdev-\u003ename. Drop the netdev reference before releasing RTNL\nonce all accesses to the device are complete."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - ib_get_eth_speed() is reached via ib_query_port() -\u003e driver query_port (rxe_query_port, siw_query_port, irdma, bnxt_re, hns, mana, erdma...) from local uverbs QUERY_PORT ioctls on /dev/infiniband/uverbs*, RDMA_NLDEV_CMD_PORT_GET netlink or the ib cache work; no remote peer supplies data to this path.\nAC:H - The faulty call needs the port\u0027s bound netdev to be between NETDEV_UNREGISTER/ndo_uninit and the queued ib_unregister_device_queued() teardown. The querying user can hammer query_port, but unregistering that netdev is an admin or driver action they cannot arrange on demand.\nPR:L - The query side needs no capability: RDMA_NLDEV_CMD_PORT_GET has no RDMA_NL_ADMIN_PERM flag, and uverbs query_port only needs an open uverbs device. Binding rxe/siw via RDMA_NLDEV_CMD_NEWLINK needs init-ns CAP_NET_ADMIN, so the attacker relies on an existing RoCE/iWARP port.\nUI:N - No victim action is needed. The attacker only issues port queries, and the unregister event is a system state change (counted under AC:H), not a user being tricked into doing something.\nS:U - The bug and its impact are both in the host kernel. No VM, IOMMU or sandbox boundary is crossed.\nC:H - __ethtool_get_link_ksettings() runs on a netdev whose ndo_uninit has already run. For example, ipvlan_ethtool_get_link_ksettings() dereferences ipvlan-\u003ephy_dev after ipvlan_port_put() dropped the port\u0027s phy_dev reference, which lets freed net_device memory be read.\nI:H - The stale or freed lower net_device is used to load and call ethtool_ops-\u003eget_link_ksettings through a function pointer. A use-after-free that reaches an indirect call can be groomed toward control-flow hijack.\nA:H - syzbot hit this as a kernel crash. Calling ethtool callbacks on a torn-down device (freed pcpu/port state in macvlan/ipvlan/team uninit) oopses the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:09.934Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/be4b44c8b47c67a04c08b1a0aba18006b749ae6a"
        },
        {
          "url": "https://git.kernel.org/stable/c/45c60ffc79771bad154f224a05753191cf1b37bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/520cd057f138ed8dbe8e05f0eae3a8ed4c5d3a5e"
        },
        {
          "url": "https://git.kernel.org/stable/c/a219459fbd1b2598e63c81a52847eba6c28b72d2"
        },
        {
          "url": "https://git.kernel.org/stable/c/5bd42f74ec3b4f4687fb600f367af0828d513b3c"
        },
        {
          "url": "https://git.kernel.org/stable/c/ef9fbe1b93f3b617b96e86d5cd76b3fa44514cb5"
        }
      ],
      "title": "RDMA/core: Reject unregistering netdevs in ib_get_eth_speed",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98359",
    "datePublished": "2026-10-06T08:46:45.938Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-19T09:18:09.934Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "b7d2118660545a00b21e83010ded1a231c6fb8c5",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "5d9426a74fc8cb8f375fcdc19b465a030f9b8cab",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "2f3b705144e3a3c14184fec6e354680081fe91ec",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "3431f525718f6b07da308cda6d44f8cb548bbd37",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            },
            {
              "lessThan": "d10e2a08799e858d3e71ea4169bcd018f216d444",
              "status": "affected",
              "version": "8700e3e7c4857d28ebaa824509934556da0b3e76",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/rxe/rxe_mr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.8"
            },
            {
              "lessThan": "4.8",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.54",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.8",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.54",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.8",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.8",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access\n\nmr_check_range() validates that [iova, iova+length) falls within the\nregistered MR range using wraparound-prone arithmetic:\n\n    if (iova \u003c mr-\u003eibmr.iova ||\n        iova + length \u003e mr-\u003eibmr.iova + mr-\u003eibmr.length)\n\nA remote peer can craft an RDMA-Write/Read RETH so that iova + length\nwraps to 0 (e.g. iova=0xfffffffffffffff8, length=8), bypassing the\ncheck. rxe_mr_iova_to_index() then computes a huge index (int idx, only\nguarded by WARN_ON) and rxe_mr_copy_xarray() dereferences\nmr-\u003epage_info[huge], causing an out-of-bounds read/write and a kernel\noops that is triggerable by an unauthenticated remote peer.\n\nRewrite the check in overflow-safe form; the first two clauses guarantee\nthat the subsequent subtractions do not underflow:\n\n    if (iova \u003c mr-\u003eibmr.iova ||\n        length \u003e mr-\u003eibmr.length ||\n        iova - mr-\u003eibmr.iova \u003e mr-\u003eibmr.length - length)\n\nWith the fix, mr_check_range() returns -EINVAL for the crafted iova and\nthe responder reports REMOTE_ACCESS_ERROR instead of triggering the OOB."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bad iova and length come from the RETH header of a RoCEv2 RDMA WRITE/READ (UDP/IP, routable). qp_resp_from_reth() copies them into qp-\u003eresp, and check_rkey() hands them to mr_check_range(), where iova+length wraps past 2^64 and the bounds check passes.\nAC:L - The attacker is the connected RC peer, so it controls the QPN, PSN and RETH contents and chooses va near 2^64 to make iova+length wrap for any MR. The bug fires on the first packet, with no race or memory layout to win.\nPR:N - RoCE has no authentication. check_addr() only matches the peer\u0027s IP address, and services such as rtrs-srv send MR rkeys with IB_ACCESS_REMOTE_WRITE to any client that connects, without checking credentials.\nUI:N - No victim action is needed. The responder processes the attacker\u0027s RETH request entirely in kernel receive context once the QP is connected.\nS:U - The out-of-bounds access corrupts or discloses kernel memory on the same host, inside the kernel\u0027s own security authority. No VM or IOMMU boundary is crossed.\nC:H - For RDMA READ, rxe_mr_copy_xarray() memcpy()s from a struct page pointer read out of bounds of mr-\u003epage_info[], and that data is sent back to the remote peer. Choosing va moves the index over a window of about 2^20 entries.\nI:H - For RDMA WRITE, rxe_mr_copy_xarray() memcpy()s the peer\u0027s payload into the page pointed to by the out-of-bounds page_info[idx].page entry. That is a remote write into kernel-chosen memory, which can be used to hijack control flow.\nA:H - An out-of-bounds page_info index, past the WARN_ON in rxe_mr_iova_to_index(), dereferences garbage page pointers and oopses the kernel. A remote peer can repeat this at will."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-19T09:18:17.324Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/b7d2118660545a00b21e83010ded1a231c6fb8c5"
        },
        {
          "url": "https://git.kernel.org/stable/c/5d9426a74fc8cb8f375fcdc19b465a030f9b8cab"
        },
        {
          "url": "https://git.kernel.org/stable/c/2f3b705144e3a3c14184fec6e354680081fe91ec"
        },
        {
          "url": "https://git.kernel.org/stable/c/3431f525718f6b07da308cda6d44f8cb548bbd37"
        },
        {
          "url": "https://git.kernel.org/stable/c/d10e2a08799e858d3e71ea4169bcd018f216d444"
        }
      ],
      "title": "RDMA/rxe: Fix integer overflow in mr_check_range() leading to OOB access",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98365",
    "datePublished": "2026-10-06T08:46:50.834Z",
    "dateReserved": "2026-09-25T10:25:14.344Z",
    "dateUpdated": "2026-10-19T09:18:17.324Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2026-10-15T22:07:24.590Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "url": "http://www.openwall.com/lists/oss-security/2026/10/15/5"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-99999",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-10-16T15:49:03.519458Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-20",
                "description": "CWE-20 Improper Input Validation",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-10-19T21:19:28.844Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a464d950f31c89565cbaae038cc60db04fe01956",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "0fab003ef4698e0628060a45a48f14b43ba2a40a",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "94524b7b32691de2e2ce162c04d6cbc9106e5cbf",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "a65f69e0f38ffbed1b128029e09097436416dc8b",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "32a8b0adaa18e52aaa0b246b5ffe683075354dbb",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "f3e835af6226f1dd12160cbd696081e9b6155de0",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "c3e33464746166264334641dc850a36eef7e6326",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            },
            {
              "lessThan": "6785011f8b16abf40b1e9d8b2e332232b3e68822",
              "status": "affected",
              "version": "f43798c27684ab925adde7d8acc34c78c6e50df8",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/ip.h",
            "net/bridge/netfilter/nf_conntrack_bridge.c",
            "net/ipv4/ip_output.c",
            "net/netfilter/nfnetlink_queue.c",
            "net/netfilter/xt_CHECKSUM.c",
            "net/xfrm/xfrm_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.27"
            },
            {
              "lessThan": "2.6.27",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.272",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.223",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.190",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.159",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.113",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.57",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.272",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.223",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.190",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.159",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.113",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.57",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.11",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "2.6.27",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.3,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - A malicious microVM supplies crafted virtio-net checksum metadata with its outbound frame. The VMM writes it to the host TAP, where tun_get_user() feeds the skb to the IPv4 stack and ip_do_fragment() calls skb_checksum_help(); this is a guest/local virtual-device path, not an Internet receive path.\nAC:L - The guest controls the frame, checksum start and offset, and packet size and can repeat the same fragmentation sequence. No race, timing window, or uncontrollable memory layout is needed; host leak, crash, and code-execution variants were reproduced with crafted packets.\nPR:N - In the microVM scenario, a tenant workload able to transmit through its assigned virtio-net interface can supply the triggering traffic. It needs no host credentials, capability, or access to /dev/net/tun; the privileged VMM merely forwards guest output to its existing TAP fd.\nUI:N - The attacker sends the crafted guest packets directly, and host TAP/IPv4 processing invokes checksum completion automatically. No host administrator or other victim must act.\nS:C - The checksum metadata originates in an untrusted microVM, but skb_checksum_help() and ip_do_fragment() process and corrupt state in the host kernel. The demonstrated leak, crash, and administrator code execution cross the guest-to-host isolation boundary.\nC:H - After skb_checksum_help() changes an already-validated IPv4 IHL, ip_do_fragment() trusts the new length and ip_frag_next() copies beyond the skb\u0027s logical linear head into transmitted IPv4 options. This was demonstrated as continuous host-memory disclosure in guest-emitted packets.\nI:H - skb_checksum_help() writes at the attacker-controlled checksum position inside an IPv4 header after routing and validation, and downstream code trusts the modified fields. Crafted guest packets using this flaw were demonstrated to execute commands with full administrator privileges on the host.\nA:H - Malformed checksum offsets reach skb_checksum_help() from IPv4 fragmentation and can trip WARN_ONCE/panic paths or poison the header geometry used downstream. Crafted guest packets were demonstrated to crash the physical host, taking down all sandboxes on it."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:17:15.740Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a464d950f31c89565cbaae038cc60db04fe01956"
        },
        {
          "url": "https://git.kernel.org/stable/c/0fab003ef4698e0628060a45a48f14b43ba2a40a"
        },
        {
          "url": "https://git.kernel.org/stable/c/94524b7b32691de2e2ce162c04d6cbc9106e5cbf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a65f69e0f38ffbed1b128029e09097436416dc8b"
        },
        {
          "url": "https://git.kernel.org/stable/c/32a8b0adaa18e52aaa0b246b5ffe683075354dbb"
        },
        {
          "url": "https://git.kernel.org/stable/c/f3e835af6226f1dd12160cbd696081e9b6155de0"
        },
        {
          "url": "https://git.kernel.org/stable/c/c3e33464746166264334641dc850a36eef7e6326"
        },
        {
          "url": "https://git.kernel.org/stable/c/6785011f8b16abf40b1e9d8b2e332232b3e68822"
        },
        {
          "url": "https://pwn.ai/blog/pwnescape"
        },
        {
          "url": "https://vercel.com/blog/findings-from-the-1-million-dollar-vercel-sandbox-challenge"
        }
      ],
      "title": "ipv4: validate checksum_start before completing checksum",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-99999",
    "datePublished": "2026-10-15T12:19:22.784Z",
    "dateReserved": "2026-09-25T10:25:14.451Z",
    "dateUpdated": "2026-10-24T14:17:15.740Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2"
}