IT SBIT Services
Schneeberger
DEEN
CVE tracker

Linux kernel: Use-after-free in RDS InfiniBand memory region registration

CVE-2026-98524High 7.8

← All vulnerabilities

Summary

A flaw in the Linux kernel RDS (Reliable Datagram Sockets) code over InfiniBand leaves a dangling scatterlist pointer in a memory region (MR) pool entry when DMA mapping or registration fails. A local user with low privileges can trigger a use-after-free, which may lead to local privilege escalation. The attack requires a local foothold and RDS being available on the host.

Affected

  • Linux kernel versions with the RDS InfiniBand code (rds: ib) from commit 1659185fb4d0 onwards, before the fix commits listed in the sources
  • OSV range: introduced in 4.6, fixed in 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9
  • Ubuntu 22.04 LTS, 24.04 LTS and 26.04 LTS: vulnerable, fix in progress; 20.04 LTS and 18.04 LTS: vulnerable, no fix

Fixed in

  • Stable kernel fixes are referenced by kernel.org commits in the sources; check the commit for your branch
  • Fixed in stable releases 5.10.271, 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9 and later (per OSV and CNA record)
  • Ubuntu fix not yet published at the time of research

Workaround

  • No vendor-published workaround known.
  • If RDS is not needed, make sure the rds module is not loaded or is blacklisted; verify with your distribution documentation first.
  • Limit local shell access on affected hosts.

Exploitation

  • No known in-the-wild exploitation.
  • No public proof of concept known.
  • CVSS 3.1: 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Our recommendation

  • Check whether hosts load the rds module or have InfiniBand hardware.
  • Install the patched kernel from your distribution as part of the next regular kernel update; prioritise shared hosts and InfiniBand or Oracle cluster systems.
  • Restrict local access and monitor for unexpected privilege escalation.
  • Verify the fix status with your distribution's security tracker, as some releases have no fix yet.

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 23:42.

Original description (NVD)

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

NVD references (8)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed