CVE-2026-98358

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/iser: reject a remote invalidation of an unregistered direction

A write command whose data is sent entirely as immediate data is not

registered. iser_reg_mem_fastreg() takes the DMA key path and leaves

rdma_reg[ISER_DIR_OUT].desc at NULL, while iser_dma_map_task_data() has

already set dir[ISER_DIR_OUT].

iser_check_remote_inv() looks at dir[] alone and hands the descriptor to

iser_inv_desc(), which reads desc->sig_protected. A target that answers

such a command with IB_WR_SEND_WITH_INV faults the initiator.

Leaving those commands unregistered is deliberate.

The same function already terminates the connection when a target sends

a remote invalidation the initiator did not ask for. A target that

invalidates a direction that was never registered is in the same class,

so give it the same answer.

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000004: 0000 [#1] SMP KASAN NOPTI

KA

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References