CVE-2026-98355

What it actually does

Null pointer dereference in RDMA/rtrs client error cleanup path when rtrs_clt_close_conns is invoked after init_path failure, allowing event tracing to access a NULL kobj name.

Why it matters to the business

Kernel panic or denial of service on systems using RDMA transport, potentially disrupting high-performance storage or networking workloads until patched.

How an attack unfolds

An attacker with local access or the ability to trigger RDMA client path initialization failures can force the error handling routine to dereference a null pointer in tracing code, causing a crash.

How to fix it

Apply the upstream kernel patch that adds a null check before copying the kobj name in the tracing path; rebuild and deploy updated kernel packages across affected systems.

How to confirm the fix worked

Confirm the null guard is present in the rtrs tracing code and test error injection during init_path to ensure cleanup no longer crashes.

Typical attack path

1. Trigger error condition during RDMA client path initialization
2. Invoke cleanup routine rtrs_clt_close_conns
3. Reach event tracing code that reads clt_path->kobj->name without a null check
4. Cause null pointer dereference leading to kernel oops or panic

How to detect it

Review kernel logs for rtrs-related null pointer dereference oops; inspect crash dumps for calls originating from rtrs_clt_close_conns during path cleanup.

What your security team should do

• Prioritize kernel updates for any hosts using RDMA/rtrs
• Monitor for kernel oops logs related to rtrs tracing
• Restrict unprivileged local access on RDMA-enabled systems until patched