Live › vulnerability › CVE-2026-98524
Go to dashboardWhen RDS InfiniBand memory registration fails, the kernel keeps a dangling pointer to a freed scatterlist in the MR pool. Tearing that MR down later reads freed memory, which the advisory says can lead to local privilege escalation.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Systems running a Linux kernel with RDS over InfiniBand support that can be reached by local users able to call rds setsockopt. Hosts that do not load the RDS module are not exposed. Exact affected kernel ranges are unknown from the sources.
No product ranges from the sources yet.
uname -r and compare against the fixed kernel builds listed by the distribution or the NVD entrylsmod | grep rds to see whether the RDS module is loadedmodprobe -r rds_rdma or blacklist the rds module (unknown whether this exact module name applies)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
rds: ib: Clear the sg list when mapping an MR fails
rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set.
This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down:
BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8
Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt
Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
This page as .md · .json · in your agent: get_signal("CVE-2026-98524")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.