CVE-2026-98357

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: wait for deferred control PDU completions before releasing the connection

isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and

ISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work

item then runs isert_completion_put() -> isert_put_cmd(), which reads

isert_conn->conn and takes conn->cmd_lock.

Nothing orders that work item against teardown. isert_wait_conn() queues

isert_release_work, which frees isert_conn, and iscsit_close_connection()

frees the iscsit_conn right after it returns, so the queued work can run

against freed memory.

Count the deferred control PDU completions per connection and let

isert_wait_conn() wait for them before the release work is queued.

ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs

iscsit_logout_post_handler(), which ends up waiting for

conn->conn_wait_comp, and that completion is only sent by

iscsit_close_connection()

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References