Answer in brief
CVE-2026-98524 records a High severity (CVSS 7.8) vulnerability in rds: ib: Clear the sg list when mapping an MR fails. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=1659185fb4d0025835eb2058a141f0746c5cab00 <1be3211e6ac77adbb1eac01314d989d243b32c59 || >=1659185fb4d0025835eb2058a141f0746c5cab00 <c42d316163f89cd23de2f3e24558177a8c29bad8 || >=1659185fb4d0025835eb2058a141f0746c5cab00 <8dca3c81344532a7f05edb3d12f31f3009410a90 || >=1659185fb4d0025835eb2058a141f0746c5cab00 <49ba5ed0129906e0362c2e4b5e21c89b2a41e115 || >=1659185fb4d0025835eb2058a141f0746c5cab00 <4468df5bcdef959fd96494e9968f323561a45f4c || >=1659185fb4d0025835eb2058a141f0746c5cab00 <e2ee0616260080376123997488b5cf8a3870b8d9 || >=1659185fb4d0025835eb2058a141f0746c5cab00 <b36d32f30c3f1e58e3a5ae79d0f52836a316b36e || >=1659185fb4d0025835eb2058a141f0746c5cab00 <58eb1b3325edac42dc6df72c80962bd53a3c8ca7 | 1be3211e6ac77adbb1eac01314d989d243b32c59, c42d316163f89cd23de2f3e24558177a8c29bad8, 8dca3c81344532a7f05edb3d12f31f3009410a90, 49ba5ed0129906e0362c2e4b5e21c89b2a41e115, 4468df5bcdef959fd96494e9968f323561a45f4c, e2ee0616260080376123997488b5cf8a3870b8d9, b36d32f30c3f1e58e3a5ae79d0f52836a316b36e, 58eb1b3325edac42dc6df72c80962bd53a3c8ca7 |
| Linux/Linuxgeneric | 4.6 | Not reported |
Published upstream
Oct 18, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 24, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Oct 18, 2026
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Quoted source text, attributed separately from HOL analysis.