CVE-2026-98358

A flaw was found in the Linux kernel's iSCSI Extensions for Remote Direct Memory Access (iSER) driver. A remote storage target can trigger a Denial of Service (DoS) by sending an unexpected remote invalidation response for write operations transmitted as immediate data. In this scenario, the initiator driver attempts to access an unregistered memory descriptor, resulting in a null pointer dereference and a kernel crash.

This vulnerability is rated as Moderate impact because triggering the denial of service requires an active connection to an untrusted or compromised remote storage server over iSER, limiting the attack surface. In standard Red Hat Enterprise Linux deployments, the iSER kernel module is not loaded by default and is only utilized when iSCSI over InfiniBand or RoCE is explicitly configured. While a malicious target can crash the host kernel, the issue does not allow privilege escalation or direct data leakage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.