Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-98524— rds: ib: Clear the sg list when mapping an MR fails

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： rds: ib：当映射内存区域（MR）失败时，清除散列列表（sg list） 函数在 DMA 映射和注册可能失败之前，就将调用方提供的散列列表（scatterlist）存储到了内存区域（MR）中。一旦发生失败， 会解除页面固定（unpin）并释放散列列表，但 仍可能将包含陈旧指针的 MR 返回到资源池中。 这会导致资源池中残留悬空散列列表，进而引发本地权限提升漏洞。当该 MR 随后被销毁时，KASAN 会检测到由此产生的释放后使用（use-after-free）问题：

CVSS 7.8 · High EPSS 0.17% · P6

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 1659185fb4d0025835eb2058a141f0746c5cab00< 1be3211e6ac77adbb1eac01314d989d243b32c59 affected
1659185fb4d0025835eb2058a141f0746c5cab00< c42d316163f89cd23de2f3e24558177a8c29bad8 affected
1659185fb4d0025835eb2058a141f0746c5cab00< 8dca3c81344532a7f05edb3d12f31f3009410a90 affected
1659185fb4d0025835eb2058a141f0746c5cab00< 49ba5ed0129906e0362c2e4b5e21c89b2a41e115 affected
1659185fb4d0025835eb2058a141f0746c5cab00< 4468df5bcdef959fd96494e9968f323561a45f4c affected
1659185fb4d0025835eb2058a141f0746c5cab00< e2ee0616260080376123997488b5cf8a3870b8d9 affected
1659185fb4d0025835eb2058a141f0746c5cab00< b36d32f30c3f1e58e3a5ae79d0f52836a316b36e affected
1659185fb4d0025835eb2058a141f0746c5cab00< 58eb1b3325edac42dc6df72c80962bd53a3c8ca7 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-98524

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rds: ib: Clear the sg list when mapping an MR fails
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 1659185fb4d0025835eb2058a141f0746c5cab00 ~ 1be3211e6ac77adbb1eac01314d989d243b32c59 -
Linux Linux 4.6 -

II. Public POCs for CVE-2026-98524

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-98524

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98524 (7)

Same Patch Batch · Linux · 2026-10-18 · 435 CVEs total

CVE-2026-98548 9.8 CRITICAL sctp: discard the rest of the packet on a stale-cookie error
CVE-2026-98490 9.8 CRITICAL net: openvswitch: conntrack: fix helper UAF due to extensions realloc
CVE-2026-98464 9.3 CRITICAL RISC-V: KVM: Synchronize hrtimer callback during teardown
CVE-2026-98549 9.1 CRITICAL tcp: prevent collapsing skbs across boundary in rtx queue
CVE-2026-98451 8.8 HIGH smb: client: use finish_no_open() for non-regular inodes
CVE-2026-98466 8.2 HIGH KVM: arm64: Transfer the hyp stack pages out of the host stage-2
CVE-2026-98532 8.1 HIGH ipv6: do not let ipv6_find_hdr() return an offset past the packet end
CVE-2026-98454 8.1 HIGH smb: client: fix create context out-of-bounds reads
CVE-2026-98499 8.1 HIGH HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
CVE-2026-98510 7.8 HIGH drm/xe/vm: nuke PTs only after unlinking contested VMAs
CVE-2026-98436 7.8 HIGH accel/amdxdna: Disable device buffer exporting
CVE-2026-98507 7.8 HIGH mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish
CVE-2026-98442 7.8 HIGH net/sched: act_ct: fix helper UAF due to extensions realloc
CVE-2026-98520 7.8 HIGH drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
CVE-2026-98487 7.8 HIGH net: bridge: mdb: restart port group walk after deletion
CVE-2026-98517 7.8 HIGH drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
CVE-2026-98443 7.8 HIGH xfs: fix cursor and pointer handling when recovering iunlink buckets
CVE-2026-98515 7.8 HIGH drm/nouveau: fix double-free in nvif_vmm_dtor
CVE-2026-98441 7.8 HIGH net/sched: act_ct: avoid modifying shared unconfirmed ct entry
CVE-2026-98491 7.8 HIGH net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry

Showing top 20 of 435 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux