CVE-2026-98357

A flaw was found in the Linux kernel's iSCSI Extensions for Remote Direct Memory Access (iSER) target driver. This vulnerability can lead to arbitrary code execution or a Denial of Service (DoS) due to memory corruption. During connection teardown, background tasks process deferred control messages without proper synchronization, allowing connection memory to be released while still in use. A remote client terminating an iSCSI connection can exploit this race condition to trigger a use-after-free condition and crash the system.

This vulnerability is rated as Moderate because exploitation requires the system to be explicitly configured as an iSER storage target with RDMA networking enabled, combined with precise race-condition timing during connection teardown. In standard Red Hat Enterprise Linux installations, the affected ib_isert kernel driver is not loaded by default, significantly limiting the attack surface. Systems that do not actively configure and export storage targets over RDMA fabrics remain unaffected by this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.