---
id: "CVE-2026-98524"
kind: "vulnerability"
aliases: ["CVE-2026-98524"]
title: "Linux kernel RDS: stale scatterlist pointer in MR pool enables use-after-free"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["infiniband", "linux-kernel", "rds", "runtime", "self-hosted"]
not_affected_if: ["no-infiniband-hardware", "rds-module-not-loaded"]
published_at: "2026-10-18T16:17:03+00:00"
first_seen_at: "2026-10-23T21:57:15+00:00"
updated_at: "2026-10-25T05:25:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98524", "first_seen_at": "2026-10-23T21:57:15+00:00"}]
---

# Linux kernel RDS: stale scatterlist pointer in MR pool enables use-after-free

When RDS InfiniBand memory registration fails, the kernel keeps a dangling pointer to a freed scatterlist in the MR pool. Tearing that MR down later reads freed memory, which the advisory says can lead to local privilege escalation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds listed by the distribution or the NVD entry
- `lsmod | grep rds` to see whether the RDS module is loaded
- unknown whether the sources give a specific config option to check

## Fix

- Update the Linux kernel to a build that includes the upstream commit 'rds: ib: Clear the sg list when mapping an MR fails'
- If RDS is not needed, unload it with `modprobe -r rds_rdma` or blacklist the `rds` module (unknown whether this exact module name applies)

## Timeline

- 2026-10-23T21:57:15+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-98524

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
mapping and registration can fail. On failure, __rds_rdma_map() unpins
the pages and frees the scatterlist, but rds_ib_free_frmr() can still
return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local
privilege escalation. KASAN detects the resulting use-after-free when the
MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
Read of size 8

Call Trace:
 __rds_ib_teardown_mr
 rds_ib_unreg_frmr
 rds_ib_flush_mr_pool
 rds_ib_flush_mrs
 rds_free_mr
 rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
mapping fails, return directly while the MR fields remain clear; the caller
keeps ownership of the scatterlist and its pinned pages. If a later
registration step fails, unmap the scatterlist and clear the MR fields
before returning.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_