CVE-2026-98357

HIGHPre-NVD 8.18.1
EchelonGraph scoreHIGH confidence

“—” beside the score: it is equal to the CVSS score beside it.

Score 8.1 from GitHub Security Advisory (severity: HIGH) published 2026-10-06. A secondary CVSS source baseline 8.1; sources differ by 0.0.

Triggered by: GitHub Security Advisory CVSS
Sources: EPSS, GitHub Security Advisory, a secondary CVSS source
Trending — 4 sources updated this week
8.1EG
EchelonGraph verdictPlan a fixRemediate within your standard update timelines (the SSVC decision on this page).
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0.4%CVSS: 8.1Exploit: None knownExposed services: Not assessed

A fix is available — apply it.

In the Linux kernel, the following vulnerability has been resolved:

IB/isert: wait for deferred control PDU completions before releasing the connection

isert_send_done() hands ISTATE_SEND_TASKMGTRSP, ISTATE_SEND_REJECT and ISTATE_SEND_TEXTRSP completions off to isert_comp_wq and returns. The work item then runs isert_completion_put() -> isert_put_cmd(), which reads isert_conn->conn and takes conn->cmd_lock.

Nothing orders that work item against teardown. isert_wait_conn() queues isert_release_work, which frees isert_conn, and iscsit_close_connection() frees the iscsit_conn right after it returns, so the queued work can run against freed memory.

Count the deferred control PDU completions per connection and let isert_wait_conn() wait for them before the release work is queued.

ISTATE_SEND_LOGOUTRSP is deliberately not counted: that branch runs iscsit_logout_post_handler(), which ends up waiting for conn->conn_wait_comp, and that completion is only sent by iscsit_close_connection() after it has called iscsit_wait_conn(). Waiting for it here would deadlock. Its wait stays the existing isert_wait4logout().

The splat below is from a kernel with tracing printk()s and an msleep(200) injected into isert_do_control_comp() to widen the window:

BUG: KASAN: slab-use-after-free in isert_put_cmd+0x53d/0x620 Read of size 8 at addr ffff8881054f1038 by task kworker/u17:1/182

CPU: 0 UID: 0 PID: 182 Comm: kworker/u17:1 Tainted: G B 7.2.0-rc5-TWIDE-gb8babf08acc7 #1 PREEMPT(lazy) Tainted: [B]=BAD_PAGE Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 Workqueue: isert_comp_wq isert_do_control_comp Call Trace: dump_stack_lvl+0x53/0x70 print_report+0xd0/0x630 ? __pfx__raw_spin_lock_irqsave+0x10/0x10 ? _raw_spin_unlock_irqrestore+0x3e/0x70 ? isert_put_cmd+0x53d/0x620 kasan_report+0xce/0x100 ? isert_put_cmd+0x53d/0x620 isert_put_cmd+0x53d/0x620 ? isert_completion_put+0x305/0x330 ? isert_do_control_comp+0x2ef/0x310 process_one_work+0x633/0x1030 ? assign_work+0x11d/0x370 worker_thread+0x45b/0xd10 ? __pfx_worker_thread+0x10/0x10 ? __pfx_worker_thread+0x10/0x10 kthread+0x2c6/0x3b0 ? recalc_sigpending+0x15c/0x1e0 ? __pfx_kthread+0x10/0x10 ret_from_fork+0x36e/0x5a0 ? __pfx_ret_from_fork+0x10/0x10 ? __switch_to+0x572/0xdd0 ? __pfx_kthread+0x10/0x10 ret_from_fork_asm+0x1a/0x30

Allocated by task 48: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 __kasan_kmalloc+0x8f/0xa0 __kmalloc_cache_noprof+0x158/0x370 isert_cma_handler+0x1e3/0x2ae0 cma_cm_event_handler+0x3e/0x240 cma_ib_req_handler+0x17d9/0x4490 cm_process_work+0x41/0x330 cm_work_handler+0x5727/0xc160 process_one_work+0x633/0x1030 worker_thread+0x45b/0xd10 kthread+0x2c6/0x3b0 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30

Freed by task 184: kasan_save_stack+0x33/0x60 kasan_save_track+0x14/0x30 kasan_save_free_info+0x3b/0x60 __kasan_slab_free+0x43/0x70 kfree+0x121/0x380 iscsit_close_connection+0x7cf/0x1e60 iscsit_take_action_for_connection_exit+0x1b6/0x360 iscsi_target_tx_thread+0x472/0x690 kthread+0x2c6/0x3b0 ret_from_fork+0x36e/0x5a0 ret_from_fork_asm+0x1a/0x30

CVSS v3
8.1
EG Score
8.1HIGHhigh confidence
EG Risk
37
EG Risk 37/100

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed (value × EchelonGraph’s weight)
Severity81% × 45%
The EG Score, 8.1 of 10.
Exploitation0.4% × 40%
FIRST EPSS: the 30-day exploitation probability when EchelonGraph scored this CVE.
Automatability0% × 15%
CISA's BOD 26-04 default: no one has published Automatable for this CVE, and CISA treats it as “no” for a CVE not in KEV.
SSVC (CISA's decision table, applied by EchelonGraph): Track at low or medium mission impact; Track* at high (mission-essential systems).
Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE.
Action: A fix is available. Apply it within your standard update timelines.
EPSS PROB
0.4%
EPSS %ILE
27th
KEV
Not listed

SSVC (CISA's decision table, applied by EchelonGraph)Track at low or medium mission impact; Track* at high (mission-essential systems).

A fix is available. Apply it within your standard update timelines.

Exploitation none (no CISA value, KEV listing or exploit code on record) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). EchelonGraph holds no SSVC assessment of this CVE from CISA: none of these inputs is from Vulnrichment. EchelonGraph applied CISA's decision table to them; CISA publishes SSVC inputs and the table, not a decision for each CVE. Mission impact is CISA's Mission & Well-being decision point, and only you can judge it. CISA's table makes it high when Mission Prevalence is Essential — the vulnerable component "directly provides capabilities that constitute at least one MEF for at least one entity" (MEF: mission essential function) — or when Public Well-Being Impact is Irreversible: "multiple fatalities are likely", the cyber-physical system "is likely lost or destroyed", "extreme or serious externalities" are imposed on other parties, or social systems such as elections or the financial grid "are destabilized and potentially collapse". CISA's decision table

BOD 26-04 (CISA's remediation timeline, Table 1)14 days if the affected system is publicly exposed; Fix on system upgrade if it is not.

In CISA KEV no (CISA's KEV catalog) · Automatable no (CISA's BOD 26-04 default) · Technical impact total (CISA's BOD 26-04 default). Where an input reads “CISA's BOD 26-04 default”, no one has published it for this CVE, and CISA's implementation guidance says: “If “Automatable” and “Technical Impact” information items about a CVE ID are not available and the CVE ID is not in the KEV Catalog, CISA will treat its values as “no” and “total,” respectively, until CISA or a third party provides metadata about the CVE ID. CISA will always provide the Vulnrichment data for a CVE ID listed in the KEV Catalog.” Whether your system is publicly exposed is yours to answer. BOD 26-04 binds US Federal Civilian Executive Branch agencies; for anyone else it is CISA's published timeline, a reference rather than an obligation. The directive · how EchelonGraph applies it

Published

October 6, 2026

Last Modified

October 7, 2026

Advisory Details (8)

Auto-updated Oct 7, 2026
Patch available.
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/a8fe3dfce8c0d8a76dc3d8486a5bff5feebe156f
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/7908fbc597a694bbd99bfb59ece73bc3daded68e
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/b96b8b3e41c308f606ffd10cfef1a7b9f97414cd
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/7edb8a88d6c76237c8b4435765bee1009e26a50a
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/505b242d9351690d1385bbe508ab4666f60363ce
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/0e230917670c6e6fe3243abfa11299fcbe05b1f4
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/ccdb1523f12bc8a9646de65055d1aafed9e9bcc6
Web page

IB/isert: wait for deferred control PDU completions before releasing the connection - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/f5613acbe2e346d5c466ef0bd264fca936b69f82

Vendor Advisories for CVE-2026-98357(2)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Affected Packages

(3 across 3 ecosystems)
Debian:12(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.1.106-1 ... 7.2~rc7-1~exp1 (360 versions)
  • every version on: no fix on record
—
Debian:13(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 7.2~rc7-1~exp1 (183 versions)
  • every version on: no fix on record
—
Debian:14(1)
PackageVulnerable rangeFix by version rangeDependents
linux6.12.100-1 ... 7.2~rc7-1~exp1 (181 versions)
  • every version up to 7.2.8-1: fixed in 7.2.8-1
—

Data Freshness Timeline

(refreshed 36× in last 7d / 46× in last 30d)

Each row is a time one of our pipelines fetched, updated or re-scored this CVE. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. An arrow marks a change the record states ("CVSS v3 → 9.1"); EPSS and GHSA rows show the values recorded at that time, not what changed (EPSS values are rounded; hover one for the exact figures). Most recent first.

  1. 2026-10-13 16:35 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  2. 2026-10-13 03:57 UTCEG score recompute
  3. 2026-10-13 03:57 UTCVendor advisory
  4. 2026-10-13 03:57 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  5. 2026-10-12 16:35 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  6. 2026-10-12 14:38 UTCEG score recompute
  7. 2026-10-11 19:10 UTCEG score recompute
  8. 2026-10-11 19:03 UTCVendor advisory
  9. 2026-10-11 19:02 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  10. 2026-10-11 16:24 UTCEG score recompute
  11. 2026-10-11 13:50 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  12. 2026-10-11 13:37 UTCEG score recompute
  13. 2026-10-11 07:08 UTCEG score recompute
  14. 2026-10-11 07:08 UTCVendor advisory
  15. 2026-10-11 07:08 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  16. 2026-10-10 20:00 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  17. 2026-10-10 19:14 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  18. 2026-10-10 07:20 UTCEG score recompute
  19. 2026-10-10 07:20 UTCVendor advisory
  20. 2026-10-10 07:20 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  21. 2026-10-09 20:08 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  22. 2026-10-09 19:26 UTCVendor advisory
  23. 2026-10-09 19:26 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  24. 2026-10-09 07:33 UTCVendor advisory
  25. 2026-10-09 07:33 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
Show 21 more
  1. 2026-10-08 19:38 UTCEG score recompute
  2. 2026-10-08 19:38 UTCVendor advisory
  3. 2026-10-08 19:38 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  4. 2026-10-08 17:14 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  5. 2026-10-08 07:23 UTCEG score recompute
  6. 2026-10-08 07:23 UTCVendor advisory
  7. 2026-10-08 07:23 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  8. 2026-10-07 23:48 UTCEPSS rescoreEPSS 0.4% · 27th percentile
  9. 2026-10-07 19:30 UTCEG score recompute
  10. 2026-10-07 19:30 UTCVendor advisory
  11. 2026-10-07 19:30 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c · GitHub severity HIGH · GitHub CVSS 8.1
  12. 2026-10-07 07:29 UTCEG score recompute
  13. 2026-10-07 07:29 UTCVendor advisory
  14. 2026-10-07 07:29 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c
  15. 2026-10-07 06:57 UTCEG score recomputeFirst assessed: 8.1 HIGH
  16. 2026-10-07 06:57 UTCGHSA enrichmentGHSA-888p-vhhf-cr6c
  17. 2026-10-07 06:56 UTCMITRE cvelistV5CVSS v3 → 8.1 · severity → HIGH
  18. 2026-10-06 15:19 UTCEPSS rescoreEPSS 0.2% · 5th percentile
  19. 2026-10-06 09:28 UTCNVD update
  20. 2026-10-06 08:53 UTCEG score recompute
  21. 2026-10-06 08:52 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-98357?
CVE-2026-98357 is a high-severity vulnerability; its CVE record was published on October 6, 2026. In the Linux kernel, the following vulnerability has been resolved: IB/isert: wait for deferred control PDU completions before releasing the connection isertsenddone() hands ISTATESENDTASKMGTRSP, ISTATESENDREJECT and ISTATESENDTEXTRSP completions off to isertcompwq and returns. The work item then…
When was the CVE record for CVE-2026-98357 published?
The CVE record for CVE-2026-98357 was published on October 6, 2026. That is the record's publication date; the vulnerability itself may have been made public earlier. EchelonGraph's copy of the record carries a last-modified date of October 7, 2026; the record at its source may have been updated since.
Is CVE-2026-98357 actively exploited?
CVE-2026-98357 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0.4% probability of exploitation in the next 30 days (27th percentile of EPSS-scored CVEs).
What is the CVSS score of CVE-2026-98357?
CVE-2026-98357 has a CVSS base score of 8.1 (a secondary CVSS source that NVD displays; NVD's own analysis pending).
How do I remediate CVE-2026-98357?
A fix for CVE-2026-98357 is available: update to the fixed version the vendor names in its advisory. The vendor advisories EchelonGraph has for CVE-2026-98357 are linked in the Vendor Advisories panel on this page.

Dependency Blast Radius

See which npm, PyPI, Go, and Maven packages are affected by CVE-2026-98357

Explore →

Is Your Infrastructure Affected by CVE-2026-98357?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Book a Demo →Browse All CVEs