Bug 2546389 (CVE-2026-98355)

Summary:	CVE-2026-98355 kernel: RDMA/rtrs: guard against null kobj name
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	akhatavk, aos-team-art-private, asdas, dpaolell, jdelft, jupierce, lgarciaa, mbiarnes, ppalepu, ppostler, prdhamdh, rhel-process-autobot, sghai, sidsharm, suppawar, vlaad, watson-tool-maintainers
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) subsystem. When connection path initialization fails in the RDMA Transport (RTRS) driver, error cleanup routines invoke event tracing before the associated object name is set. This issue leads to a null pointer dereference, allowing a user or network peer capable of triggering connection errors to crash the system, resulting in a Denial of Service (DoS).	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-06 09:12:05 UTC

In the Linux kernel, the following vulnerability has been resolved:

RDMA/rtrs: guard against null kobj name

In the client, if `init_path()` errors, the callee tries to clean up
with `rtrs_clt_close_conns()`. However, this can lead to calling the
event tracing code with `clt_path->kobj->name` being `NULL` and thus
causing a null pointer dereference when trying to copy from it.

This just adds a guard to check that the name is not `NULL` before
copying from it. The server appears to have a similar pattern.

Comment 1 gkamathe 2026-10-07 07:03:20 UTC

Upstream advisory:
https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98355.mbox