All vulnerabilities
CVE-2026-98524

Linux: rds: ib: Clear the sg list when mapping an MR fails

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.22%Chance of exploitation activity in the next 30 days, higher than 11% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in1be3211e6ac77adbb1eac01314d989d243b32c59Also 8dca3c81344532a7f05edb3d12f31f3009410a90, 49ba5ed0129906e0362c2e4b5e21c89b2a41e115 and 2 moreCVE List
Published18 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 1be3211e6ac77adbb1eac01314d989d243b32c59LinuxCVE List
  • 8dca3c81344532a7f05edb3d12f31f3009410a90LinuxCVE List
  • 49ba5ed0129906e0362c2e4b5e21c89b2a41e115LinuxCVE List
  • 4468df5bcdef959fd96494e9968f323561a45f4cLinuxCVE List
  • 58eb1b3325edac42dc6df72c80962bd53a3c8ca7LinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8

Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

Text from CVE List

Affected versions 18

  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before 1be3211e6ac77adbb1eac01314d989d243b32c59CVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before c42d316163f89cd23de2f3e24558177a8c29bad8CVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before 8dca3c81344532a7f05edb3d12f31f3009410a90CVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before 49ba5ed0129906e0362c2e4b5e21c89b2a41e115CVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before 4468df5bcdef959fd96494e9968f323561a45f4cCVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before e2ee0616260080376123997488b5cf8a3870b8d9CVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before b36d32f30c3f1e58e3a5ae79d0f52836a316b36eCVE List
  • Linuxaffected: 1659185fb4d0025835eb2058a141f0746c5cab00 before 58eb1b3325edac42dc6df72c80962bd53a3c8ca7CVE List
  • Linuxaffected: 4.6CVE List
  • Linuxunaffected: all versions before 4.6CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8