{"id":"CVE-2026-98524","kind":"vulnerability","aliases":["CVE-2026-98524"],"related":[],"title":"Linux kernel RDS: stale scatterlist pointer in MR pool enables use-after-free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.","summary":"When RDS InfiniBand memory registration fails, the kernel keeps a dangling pointer to a freed scatterlist in the MR pool. Tearing that MR down later reads freed memory, which the advisory says can lead to local privilege escalation.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infiniband","linux-kernel","rds","runtime","self-hosted"],"not_affected_if":["no-infiniband-hardware","rds-module-not-loaded"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by the distribution or the NVD entry\n- `lsmod | grep rds` to see whether the RDS module is loaded\n- unknown whether the sources give a specific config option to check","fix":"- Update the Linux kernel to a build that includes the upstream commit 'rds: ib: Clear the sg list when mapping an MR fails'\n- If RDS is not needed, unload it with `modprobe -r rds_rdma` or blacklist the `rds` module (unknown whether this exact module name applies)","status":"open","published_at":"2026-10-18T16:17:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:10+00:00","updated_at":"2026-10-25T05:25:10+00:00","category":"runtime","confidence":0.6,"triage":{"at":"2026-10-25T05:25:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a build that includes the upstream commit 'rds: ib: Clear the sg list when mapping an MR fails'\n- If RDS is not needed, unload it with `modprobe -r rds_rdma` or blacklist the `rds` module (unknown whether this exact module name applies)","reach":"local","title":"Linux kernel RDS: stale scatterlist pointer in MR pool enables use-after-free","impact":"high","summary":"When RDS InfiniBand memory registration fails, the kernel keeps a dangling pointer to a freed scatterlist in the MR pool. Tearing that MR down later reads freed memory, which the advisory says can lead to local privilege escalation.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","rds","infiniband","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"local user gains kernel code execution via use-after-free","analyst_note":"Find the affected and fixed kernel version ranges and the stable backport commits, starting from the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-98524.","how_to_check":"- `uname -r` and compare against the fixed kernel builds listed by the distribution or the NVD entry\n- `lsmod | grep rds` to see whether the RDS module is loaded\n- unknown whether the sources give a specific config option to check","needs_analyst":true,"not_affected_if":["rds-module-not-loaded","no-infiniband-hardware"],"who_is_affected":"Systems running a Linux kernel with RDS over InfiniBand support that can be reached by local users able to call rds setsockopt. Hosts that do not load the RDS module are not exposed. Exact affected kernel ranges are unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000695,"input_tokens":3658,"output_tokens":658,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':16A,19A '-98524':17A,20A '8':183C 'advisori':60B 'bug':168C 'call':184C 'caller':95C,232C 'clear':80C,230C,252C 'cve':15A,18A 'dangl':40B,144C 'detect':154C 'direct':224C 'dma':102C,216C,220C 'enabl':10A 'escal':67B,152C 'fail':35B,88C,107C,222C,247C 'failur':109C 'field':228C,255C 'flush':196C,201C 'follow':73C 'free':14A,117C,123C,160C,174C,204C 'freed':44B,56B 'frmr':92C,124C,193C 'host':29B 'ib':79C,90C,122C,177C,187C,191C,195C,200C 'infiniband':21B,32B 'kasan':153C,169C 'keep':38B,233C 'kernel':2A,24B,37B,71C 'later':54B,165C,244C 'lead':63B,148C 'leav':139C 'linux':1A,23B,70C 'linux-kernel':22B 'list':83C 'local':65B,150C 'map':85C,91C,103C,112C,217C,221C 'memori':33B,57B 'mr':8A,48B,52B,87C,100C,129C,163C,179C,189C,197C,205C,213C,227C,254C 'mrs':202C 'ownership':234C 'page':115C,241C 'pin':240C 'pointer':6A,41B,136C 'pool':9A,49B,132C,141C,198C 'privileg':66B,151C 'rdma':111C 'rds':3A,25B,31B,78C,89C,110C,121C,176C,186C,190C,194C,199C,203C,206C 'read':55B,180C 'registr':34B,105C,245C 'remain':229C 'resolv':77C 'result':156C 'return':127C,223C,257C 'runtim':26B 'say':61B 'scatterlist':5A,45B,97C,119C,145C,210C,237C,250C 'self':28B 'self-host':27B 'set':137C 'setsockopt':207C 'sg':82C 'size':182C 'slab':171C 'slab-use-after-fre':170C 'stale':4A,135C 'step':246C 'still':126C 'store':93C,208C 'succeed':218C 'tear':50B 'teardown':178C,188C 'torn':166C 'trace':185C 'unmap':248C 'unpin':113C 'unreg':192C 'use':12A,158C,172C 'use-after-fre':11A,157C 'vulner':74C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with RDS over InfiniBand support that can be reached by local users able to call rds setsockopt. Hosts that do not load the RDS module are not exposed. Exact affected kernel ranges are unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:03+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98524","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98524","severity":null,"published_at":"2026-10-18T16:17:03+00:00","modified_at":"2026-10-19T10:19:07+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}