CVE-2026-98524

Received Received - Intake

Use-After-Free in Linux Kernel RDS IB MR Handling

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98524

EUVD

EUVD-2026-103569

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	1659185fb4d0025835eb2058a141f0746c5cab00
Linux	Linux	4.6

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a use-after-free vulnerability in the Linux kernel's RDS (Reliable Datagram Sockets) subsystem. It occurs when mapping a memory region (MR) fails during DMA operations. The scatterlist pointer is stored prematurely, leaving a dangling reference. When the MR is later torn down, this causes a slab-use-after-free error, potentially enabling local privilege escalation.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDS (Reliable Datagram Sockets) subsystem and involves memory corruption due to improper handling of scatter-gather lists during MR (Memory Region) mapping failures. Detection requires kernel-level inspection for use-after-free conditions in the RDS subsystem, particularly during MR teardown. Check kernel logs for KASAN reports indicating slab-use-after-free in __rds_ib_teardown_mr. Use commands like dmesg | grep -i kasan or journalctl -k | grep -i kasan to search for KASAN errors.

Impact Analysis

An attacker with local access could exploit this to escalate privileges on the system. The vulnerability allows for memory corruption, which may lead to arbitrary code execution in the kernel context. This could result in full system compromise, data theft, or denial of service.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR or HIPAA as it pertains to local privilege escalation in the Linux kernel's RDS subsystem. Compliance impacts would depend on system configuration and use case rather than the vulnerability itself.

Mitigation Strategies

Apply the latest kernel patches that fix the issue in the RDS subsystem. Update to a kernel version where rds_ib_map_frmr() stores the scatterlist only after DMA mapping succeeds. If immediate patching is not possible, disable the RDS protocol module (rds) if not in use by running rmmod rds. Monitor kernel logs for signs of exploitation or crashes.

Hi! I’m here to help you understand CVE-2026-98524. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70