Cloudanix VulnDB

CVE-2026-98524

None

CVSS

—

EPSS

0.2%

Published

Oct 18, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A bug in the Linux kernel's networking code can let a local user gain more access than they should have.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Privilege Gain
Component
OS kernel
Class
Use After Free
Remediation
Patch
Effort
Medium
Patch risk
Low

What it actually does

Use-after-free in RDS InfiniBand MR handling: rds_ib_map_frmr stores a scatterlist pointer before DMA mapping succeeds; on failure __rds_rdma_map frees the list while the MR pool retains a dangling reference that is later dereferenced in __rds_ib_teardown_mr.

Why it matters to the business

Local attackers on affected Linux systems can escalate privileges, potentially compromising the entire host and any workloads that rely on RDS over InfiniBand.

How an attack unfolds

A local attacker invokes RDS socket operations that reach rds_ib_map_frmr, forces a DMA-mapping failure path, then triggers MR pool teardown via rds_free_mr or rds_setsockopt; the resulting use-after-free is exploited for privilege escalation.

How to fix it

Apply the upstream kernel commit that moves scatterlist assignment after successful DMA mapping and clears MR fields on any registration failure; rebuild and reboot to the patched kernel.

How to confirm the fix worked

Confirm the source change stores the scatterlist only after DMA succeeds; run KASAN-enabled tests that exercise RDS MR registration failure paths and verify absence of slab-use-after-free reports.

Typical attack path

  1. Call rds_setsockopt or equivalent RDS registration to enter rds_ib_map_frmr
  2. Induce DMA mapping failure so the scatterlist is freed while the MR retains the pointer
  3. Trigger rds_ib_flush_mr_pool or rds_free_mr to reach __rds_ib_teardown_mr and dereference the freed memory

How to detect it

Search kernel logs for KASAN slab-use-after-free reports containing __rds_ib_teardown_mr, rds_ib_unreg_frmr, rds_ib_flush_mr_pool, rds_ib_flush_mrs, rds_free_mr, or rds_setsockopt.

  • BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
  • Read of size 8
  • __rds_ib_teardown_mr
  • rds_ib_unreg_frmr
  • rds_ib_flush_mr_pool
  • rds_ib_flush_mrs
  • rds_free_mr
  • rds_setsockopt

What your security team should do

  • Prioritize kernel updates on all systems exposing RDS over InfiniBand
  • Restrict unprivileged use of RDS sockets via LSM or seccomp until patched
  • Enable KASAN or similar memory-safety instrumentation on test and canary hosts

The record

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

Affected packages

Ecosystem Package Introduced Fixed