From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 498393E2746 for ; Tue, 6 Oct 2026 10:29:42 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282583; cv=none; b=RGK4BTC1xlh6T4UpsgfHt2UYcEaz53ZJdt55xodaBlxWYI43ilNCiVDbedqtIPPBsY98jeq6e5byeNXlxqSyLDuPVemvl0A9Vt7idRSgH7AuOnrcT/zwMw7G2S3tGfPrcSR0ZcNQhwPiDBGAYawImWdkm74t7SfKQeyItoMNWJc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791282583; c=relaxed/simple; bh=frFL1FTXTjLcYfWYUtx2cy8rn5jY7NEoIG0L0J6OfZs=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Dy2fBHdpiAyKG2o/su0iDB+dyPMEj6pj50A7ogZSYJZBHqFBrhyfEC4+1yPv+NnT2XvUFanivHlyIDH4VZ2B+3etjF8+NS0LVJ3tI3ROD2ZZC632CYXiwfC512y2Dp8JiZwUyKW62PKOp8O6OcDQ2KU/nkfscQLr3ZmT5bgwtGY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=QQ9HskSS; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="QQ9HskSS" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 62A1F1F000FF; Tue, 6 Oct 2026 10:29:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791282581; bh=J0C+TIkVev734SLkDmvOfL7wGui4BOM+zmJ+lIZ/s+s=; h=From:To:Cc:Subject:Date:Reply-To; b=QQ9HskSScxkgJTJWr+LIQ8aCzbipXmX87+/xfwIrXSefO51limATYC9AA7HhzNOE8 HT3HIbGR8WmJTRbsI05TGsEi8VOWp8gVZBeUxGy9J6WvtIJijycvCntj1HpdCTLpUv E1tCTxOgJRcihSmcqSZhl/5LVNOs0s9auXBvB7ME= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98355: RDMA/rtrs: guard against null kobj name Date: Tue, 6 Oct 2026 10:47:36 +0200 Message-ID: <2026100620-CVE-2026-98355-088d@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2221; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=bzOfFaq2u/5tIUA0LVAaLorJ7W4sD+H4RxmuWdsH2xs=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlHtir03Tpw+fO6Dfb/Pmy6EO6lsP7b80Xsv8rTRWM/O SY+uhC0ryOWhUGQiUFWTJHlyzaeo/srDil6GdqehpnDygQyhIGLUwAmcmAOw3znKoOdS4VZ/2lq JJ2KM0+rm5+m3ciwoC31VGnO9meTi9McuT0bve5JlM1KBgA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: RDMA/rtrs: guard against null kobj name In the client, if `init_path()` errors, the callee tries to clean up with `rtrs_clt_close_conns()`. However, this can lead to calling the event tracing code with `clt_path->kobj->name` being `NULL` and thus causing a null pointer dereference when trying to copy from it. This just adds a guard to check that the name is not `NULL` before copying from it. The server appears to have a similar pattern. The Linux kernel CVE team has assigned CVE-2026-98355 to this issue. Affected and fixed versions =========================== Issue introduced in 6.1 with commit 5a93929d9f9a1d82946ddd49e260b6dd1756ad6d and fixed in 7.2.8 with commit f79cf42ff23f9120246cd6740eaa26f59c632a4a Issue introduced in 6.1 with commit 5a93929d9f9a1d82946ddd49e260b6dd1756ad6d and fixed in 7.3-rc4 with commit 99c24a8968ebef0573825b5cb89d5985d51635b9 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98355 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/infiniband/ulp/rtrs/rtrs-clt-trace.h drivers/infiniband/ulp/rtrs/rtrs-srv-trace.h Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f79cf42ff23f9120246cd6740eaa26f59c632a4a https://git.kernel.org/stable/c/99c24a8968ebef0573825b5cb89d5985d51635b9