Use-after-free in Linux kernel - CVE-2026-98357
Published: October 7, 2026
Vulnerability identifier: #VU153583
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98357
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to cause a denial of service.
The vulnerability exists due to a use-after-free in the Linux kernel iSER target's deferred control PDU completion handling when queued completion work executes after connection teardown has freed the connection objects. A local user can trigger connection teardown while control PDU completions remain queued to cause a denial of service.
The affected completion states are ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP. ISTATE_SEND_LOGOUTRSP follows a separate logout wait path.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-98357
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.113-1
linux (Debian package) - update to 6.12.113-1
External References
- https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4
- https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce
- https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e
- https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a
- https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f
- https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd
- https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6
- https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82