CVE-2026-98524

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA

mapping and registration can fail. On failure, __rds_rdma_map() unpins

the pages and frees the scatterlist, but rds_ib_free_frmr() can still

return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local

privilege escalation. KASAN detects the resulting use-after-free when the

MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr

Read of size 8

Call Trace:

__rds_ib_teardown_mr

rds_ib_unreg_frmr

rds_ib_flush_mr_pool

rds_ib_flush_mrs

rds_free_mr

rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA

mapping fails, return directly while the MR fields remain clear; the caller

keeps ownership of the scatterlist and its pinned pages. If a later

registration step fails, unmap

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References