CVE-2026-98357

Executive Summary

CVE-2026-98357 is a use-after-free (UAF) vulnerability in the Linux kernel's iSER (iSCSI Extensions for RDMA) target subsystem, specifically in the connection teardown path of the isert module. A race condition between deferred control PDU completion work items (queued to isert_comp_wq) and connection release work (isert_release_work) allows a queued work item to dereference isert_conn after isert_wait_conn() has already freed the underlying isert_conn and iscsit_conn structures, producing a slab-use-after-free read. The flaw is reachable on any Linux system acting as an iSCSI target with iSER enabled and exposed to a network peer capable of establishing iSER connections and issuing iSCSI control PDUs (task management, reject, or text responses). Impact is primarily availability and kernel integrity — a successful trigger yields a kernel memory-safety violation that can crash the host or, under specific heap grooming, potentially be leveraged toward privilege escalation from a remote, unauthenticated position. No public proof-of-concept, exploit code, or Nuclei template is currently available, and the CVE has not been added to CISA KEV. CVSS is not assigned by NVD as of this writing.

Technical Analysis

The vulnerability resides in the iSER target code path that handles control PDU completions during connection lifecycle management. The relevant mechanism is a lifetime/ordering bug — internally this is a use-after-free (CWE-416) driven by a synchronization gap between two work queues.

Code-level mechanism (as described):

1. isert_send_done() processes completion of certain control PDU transmissions. For three states — ISTATE_SEND_TASKMGTRSP (task management response), ISTATE_SEND_REJECT, and ISTATE_SEND_TEXTRSP (text response) — it does not process the completion inline. Instead it hands the completion off to the isert_comp_wq workqueue and returns.
2. The queued work item later executes isert_completion_put() → isert_put_cmd(). isert_put_cmd() reads isert_conn->conn and then takes conn->cmd_lock.
3. Nothing establishes ordering between that deferred work item and connection teardown. isert_wait_conn() queues isert_release_work, which frees isert_conn. Immediately after isert_wait_conn() returns, iscsit_close_connection() frees the iscsit_conn.
4. Because the deferred completion work item is not synchronized against this teardown, it can run after both objects are freed, dereferencing isert_conn->conn and acquiring a lock on freed memory. The observed KASAN report is a slab-use-after-free read of size 8 in isert_put_cmd+0x53d/0x620, from a kworker context.

Why the UAF window exists: The ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT, and ISTATE_SEND_TEXTRSP completions are effectively "fire-and-forget" from the perspective of the send path — the send is considered done, but the cleanup of the associated command happens asynchronously on a different workqueue without a reference or completion counter tying it to the connection's lifetime. Teardown therefore races against in-flight deferred completion work.

Deliberate exclusion of LOGOUTRSP: The provided description explicitly notes that ISTATE_SEND_LOGOUTRSP is intentionally not counted. That branch invokes iscsit_logout_post_handler(), which waits on conn->conn_wait_comp. That completion is only signalled by iscsit_close_connection() after it has called iscsit_wait_conn(). Counting the logout completion in the new wait logic would create a deadlock (the teardown would wait on a completion that teardown itself must signal). Logout therefore continues to use the pre-existing isert_wait4logout() synchronization.

Attack surface: The bug is in an RDMA-attached iSCSI target. Reachability requires:

• A Linux host running as an iSCSI target with the iSER transport enabled (ib_isert / iSER target support).
• An RDMA fabric (InfiniBand or RoCE) over which the peer can establish iSER connections.
• Ability to drive control PDU flows — task management responses, rejects, and text responses — and to cause connection teardown while such completions are in flight.

The race is inherently timing-dependent (the upstream demonstration inserted msleep(200) into isert_do_control_comp() specifically to widen the window), which raises the difficulty of reliable remote triggering but does not eliminate it — real-world teardown races are frequently won in practice by tiling repeated connect/PDU/teardown cycles.

Important caveat on specificity: The NVD text does not provide a CVE-recorded affected version range, CVSS vector, or CWE assignment. The kernel version referenced in the splat (7.2.0-rc5-TWIDE-gb8babf08acc7) is the reporter's instrumented build, not a precise affected-range boundary. No upstream commit hash, stable tag, or distro advisory was supplied. Analysts should treat the affected range as "Linux kernels containing the affected iSER target code prior to the upstream fix" and consult their distribution's own kernel advisories.

Exploitation Scenarios

No public PoC or exploit code exists. The chain below is inferred from the vulnerability class (kernel use-after-free via unsynchronized workqueue teardown) and the mechanism explicitly described in the NVD text. Step 3 is written at the vulnerability-class level; no function names beyond those in the description are asserted.

1. Reconnaissance / target identification An attacker with access to the RDMA fabric first identifies candidate hosts running the Linux iSCSI target with iSER enabled. Typical discovery is via network scanning of RDMA/iSCSI-reachable segments, banner or service enumeration of the target stack, or prior knowledge of an infrastructure's storage topology. A target must accept iSER connections and expose an iSCSI target to the peer.

2. Triggering the flawed condition The attacker a peer establishes iSER connections and exercises control-PDU flows that cause isert_send_done() to dispatch deferred completion work — specifically driving the states ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT, and/or ISTATE_SEND_TEXTRSP. Concurrently, the attacker induces connection teardown (for example by tearing down sessions or forcing error conditions) so that isert_wait_conn() → isert_release_work executes while a deferred completion work item is still pending on isert_comp_wq. Because nothing orders the two, the completion work item can execute against the freed isert_conn/iscsit_conn.

3. Payload / execution method (class-level) This is a race-condition use-after-free, not an injection primitive. The "payload" is timing pressure: repeated, rapid connect → control-PDU → teardown cycles used to win the window between deferred completion dispatch and object release. The reporter's own demonstration widened the window with an injected msleep(200) in isert_do_control_comp(), confirming the exploitability knob is scheduling timing — an attacker does not control that injection remotely but can attempt to saturate the workqueue and elicit the interleaving through load.

4. Post-exploitation impact A successful trigger performs a use-after-free read (and a lock acquisition) on a freed slab object from a kworker context. Immediate observable effects: kernel warning / KASAN report, lock corruption, and process/worker crash that can escalate into a host kernel panic or denial of service. Use-after-free reads can also leak stale memory or, under favorable heap reallocation by an attacker, corrupt lock state — the standard escalation path for kernel UAF, though no exploit chain has been demonstrated for this CVE. There is no reported authentication-based precondition in the description; the constraint is network reachability of the iSER target service and control over the PDU/teardown sequence.

Impact Assessment

• Confidentiality (Low/None in a pure read): The crash signature is a read of freed memory; no direct data disclosure is documented. Long-term exploitation could theoretically expose reclaimed memory contents.
• Integrity (Low–Moderate): Corruption of connection/lock state in the freed object; a determined attacker behind the same race could influence reallocated heap contents, but no such primitive is demonstrated.
• Availability (High): The demonstrated outcome is a kernel slab-use-after-free that terminates a kworker, with a realistic path to a full kernel panic. A host serving storage as an iSCSI target could take down attached data paths, affecting every initiator consuming that target.
• Scope: Remote (RDMA network), no authentication requirement implied for the race itself beyond fabric reachability — CVSS vector scope assessed as Unchanged with High availability impact (per the vector field above; the authoritative NVD score is absent and no substitute value should be assumed).
• Blast radius: Storage infrastructure hosts running iSER targets — converged RDMA storage fabrics, hyperconverged clusters, and virtualization hosts exporting block storage. Blast radius is proportional to the number of initiators depending on the affected target. No enterprise-wide lateral movement is inherent; the impact is localized to the target host and its storage consumers.

Detection Guidance

Detection centers on kernel tampering/memory-safety telemetry and on iSER/iSCSI connection churn against target hosts. Because the race is timing-driven, network signatures are best expressed as behavioral patterns (abnormal teardown rate around control PDUs) rather than a single packet match. Host-side KASAN/splat detection is the highest-fidelity signal.

Sigma Rule

title: Linux Kernel iSER Use-After-Free in Teardown Path (CVE-2026-98357)
id: 9f1b7c42-3a5e-4d8b-b6c1-7e2f0a983570
status: experimental
description: Detects kernel splats consistent with a use-after-free in isert_put_cmd during iSER connection teardown (CVE-2026-98357).
author: valtersit.com Threat Intelligence
logsource:
  product: linux
  service: kernel
detection:
  keywords_uaf:
    - 'KASAN: slab-use-after-free'
    - 'use-after-free in isert_put_cmd'
  keywords_func:
    - 'isert_put_cmd'
    - 'isert_completion_put'
    - 'isert_wait_conn'
    - 'isert_release_work'
    - 'isert_comp_wq'
  keywords_ctx:
    - 'kworker'
    - 'isert'
  condition: (keywords_uaf or keywords_func) or (keywords_ctx and keywords_func)
falsepositives:
  - Kernel development/debug builds with artificial sleeps
  - Benign iSER target teardown without memory-safety fault
level: high
tags:
  - attack.t1210
  - cve.2026-98357

YARA Rule

rule CVE_2026_98357_isert_uaf
{
    meta:
        author      = "valtersit.com Threat Intelligence"
        description = "Detects kernel log/dump artifacts referencing the iSER deferred-control-PDU use-after-free (CVE-2026-98357)"
        cve         = "CVE-2026-98357"
        severity    = "high"
    strings:
        $uaf    = "slab-use-after-free"
        $fn1    = "isert_put_cmd"
        $fn2    = "isert_wait_conn"
        $fn3    = "isert_release_work"
        $fn4    = "isert_comp_wq"
        $fn5    = "isert_completion_put"
        $iface  = "ISTATE_SEND_TASKMGTRSP" ascii
        $iface2 = "ISTATE_SEND_REJECT" ascii
        $iface3 = "ISTATE_SEND_TEXTRSP" ascii
    condition:
        ($uaf and any of ($fn*)) or (2 of ($fn*) and any of ($iface*))
}

Suricata IDS Rule

alert tcp any any -> any 3260 (msg:"CVE-2026-98357 possible iSER/iSCSI control-PDU teardown churn - iSCSI target DoS attempt"; flow:to_server; dsize:>0; content:"|00 00 00 00|"; depth:4; threshold:type both, track by_src, count 20, seconds 10; classtype:attempted-dos; metadata:cve 2026-98357, affected_product Linux_Kernel; sid:9835701; rev:1;)

Note: iSER transports iSCSI PDU semantics over RDMA; this rule is a coarse behavioral threshold on the associated TCP/3260 channel and should be tuned to the deployment. It is not a precise iSER signature.

Elastic Detection

sequence by host.id with maxspan=10s
  [process where process.name == "kworker/u17:1" or process.name :
     ("kworker/*")] by host.id
  [process where event.action == "died" and
     process.name : ("kworker/*") and
     process.args : ("*isert*","*isert_put_cmd*")]

For environments shipping kernel logs via Elastic Agent (journald/filebeat), a log-based query is preferred:

any where
  message : ("KASAN: slab-use-after-free*", "*isert_put_cmd*", "*isert_wait_conn*")

Splunk SPL Query

index=linux sourcetype=kernel OR sourcetype=syslog
| search ("KASAN: slab-use-after-free" OR "use-after-free" OR "isert_put_cmd" OR "isert_completion_put" OR "isert_wait_conn" OR "isert_release_work" OR "isert_comp_wq")
| eval severity=if(match(_raw,"slab-use-after-free|BUG: KASAN"),"HIGH","MEDIUM")
| stats count min(_time) as first_seen max(_time) as last_seen by host severity _raw
| sort - count

Wazuh OSSEC Rule

<group name="linux,cve-2026-98357,kernel,">
  <rule id="983570" level="12">
    <decoded_as>syslog</decoded_as>
    <match>isert_put_cmd|isert_completion_put|isert_wait_conn|isert_release_work|isert_comp_wq</match>
    <description>CVE-2026-98357: possible iSER control-PDU teardown use-after-free in kernel.</description>
    <mitre>
      <id>T1210</id>
    </mitre>
  </rule>
  <rule id="983571" level="13">
    <decoded_as>syslog</decoded_as>
    <match>KASAN: slab-use-after-free</match>
    <description>CVE-2026-98357: kernel KASAN slab-use-after-free detected.</description>
    <group>kernel_uaf,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source). No vendor advisory, commit hash, or distribution update was present in the supplied intelligence. The text below reflects the upstream fix concept described in the NVD entry, not a verifiable patch artifact.

1. Immediate mitigations (before an official patch is applied):

• Remove or reduce attack surface: if iSER is not required, disable the iSER transport on the Linux iSCSI target so ISTATE_SEND_TASKMGTRSP/REJECT/TEXTRSP deferred completions are never generated. Fall back to a non-iSER (e.g., TCP) iSCSI transport where the workload permits.
• Network-isolate the RDMA fabric carrying iSER traffic to trusted initiators/hosts only; enforce fabric partitioning (InfiniBand P_Key partitioning or equivalent RoCE segmentation) so only authorized initiators can reach the target.
• Rate-limit and monitor iSCSI/iSER session establishment and teardown; alert on abnormal connect/teardown churn against target hosts.
• Keep host telemetry (KASAN where feasible, kernel splat logging, panic-on-oops) enabled on storage hosts to catch an attempted trigger and contain a panic impact.

2. Patch / upgrade steps:

• Apply the upstream Linux kernel fix, "IB/isert: wait for deferred control PDU completions before releasing the connection," as soon as it is available in a released stable/LTS kernel, or the equivalent fix shipped by your distribution's kernel security update (yum/dnf update kernel, apt upgrade linux-image-*).
• Track your distribution's CVE page for CVE-2026-98357 to obtain the authoritative fixed kernel version and affected-range boundary, since none was included in this dataset.

3. Long-term hardening:

• Treat control-plane storage transports (iSER, NVMe-oF/RDMA) as trusted-boundary services and apply the same segmentation, authentication, and monitoring rigor as management interfaces.
• Enable kernel hardening telemetry (KASAN on test fleets, panic_on_oops policy scoped to storage hosts) and retain kernel splat logs for retro-hunting.
• Maintain a patching cadence for kernel/storage infrastructure where transport-level memory-safety races are routinely found; run RDMA storage endpoints on the distro LTS kernel with prompt security-stream updates.

References

• NVD CVE-2026-98357 — https://nvd.nist.gov/vuln/detail/CVE-2026-98357
• Linux kernel iSER target source and upstream fix, "IB/isert: wait for deferred control PDU completions before releasing the connection" — Linux kernel git (drivers/infiniband/ulp/isert/), as described in NVD text
• CWE-416: Use After Free — https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1210 — Exploitation of Remote Services — https://attack.mitre.org/techniques/T1210/
• CISA Known Exploited Vulnerabilities catalog (CVE-2026-98357 not listed as of this report) — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

No threat actor campaigns or exploit-in-the-wild evidence were identified in the available data. CVSS and EPSS are unassigned; no score should be inferred from this report.