CVE-2026-98524 rds: ib: Clear the sg list when mapping an MR fails
A use-after-free in the Linux kernel RDS IB module allows local attackers to escalate privileges by triggering a failure during memory registration.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98524?
CVE-2026-98524 is a high-severity use after free vulnerability in Linux, published on 18 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: Clear the sg list when mapping an MR fails
rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set.
This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down:
BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8
Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt
Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Which versions are affected by CVE-2026-98524?
How do I fix CVE-2026-98524?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2026-98524 being exploited?
There is no known exploitation of CVE-2026-98524 in the wild and no public exploit code.
Sources
Also known as AZL-109403, BELL-CVE-2026-98524, DEBIAN-CVE-2026-98524, GHSA-wq82-wxrv-wcj7, UBUNTU-CVE-2026-98524.