CVE-2026-98524: Linux Vulnerability (CVSS 7.8)

Description

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

Metrics

CVSS 3.1

7.8/10

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS Probability

0.22%

11.8th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

Vendor	Product	Versions
Linux	Linux	>= 1659185fb4d0025835eb2058a141f0746c5cab00, < 1be3211e6ac77adbb1eac01314d989d243b32c59; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < c42d316163f89cd23de2f3e24558177a8c29bad8; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < 8dca3c81344532a7f05edb3d12f31f3009410a90; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < 49ba5ed0129906e0362c2e4b5e21c89b2a41e115; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < 4468df5bcdef959fd96494e9968f323561a45f4c; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < e2ee0616260080376123997488b5cf8a3870b8d9; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < b36d32f30c3f1e58e3a5ae79d0f52836a316b36e; >= 1659185fb4d0025835eb2058a141f0746c5cab00, < 58eb1b3325edac42dc6df72c80962bd53a3c8ca7
Linux	Linux	4.6

References

Timeline

Published: Oct 18, 2026
Last Modified: Oct 24, 2026
Status: Received

Frequently Asked Questions

What is CVE-2026-98524?

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

How severe is CVE-2026-98524?

CVE-2026-98524 has a CVSS score of 7.8/10 (HIGH severity). The EPSS model estimates a 0.22% probability of exploitation in the next 30 days.

How do I fix CVE-2026-98524?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →