CVE-2026-98524: rds: ib: Clear the sg list when mapping an MR fails

CVE-2026-98524: rds: ib: Clear the sg list when mapping an MR fails

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA
mapping and registration can fail. On failure, __rds_rdma_map() unpins
the pages and frees the scatterlist, but rds_ib_free_frmr() can still
return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local
privilege escalation. KASAN detects the resulting use-after-free when the
MR is later torn down:

BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr
Read of size 8

Call Trace:
 __rds_ib_teardown_mr
 rds_ib_unreg_frmr
 rds_ib_flush_mr_pool
 rds_ib_flush_mrs
 rds_free_mr
 rds_setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA
mapping fails, return directly while the MR fields remain clear; the caller
keeps ownership of the scatterlist and its pinned pages. If a later
registration step fails, unmap the scatterlist and clear the MR fields
before returning.

The Linux kernel CVE team has assigned CVE-2026-98524 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 5.10.271 with commit 1be3211e6ac77adbb1eac01314d989d243b32c59
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 5.15.222 with commit c42d316163f89cd23de2f3e24558177a8c29bad8
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.1.189 with commit 8dca3c81344532a7f05edb3d12f31f3009410a90
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.6.158 with commit 49ba5ed0129906e0362c2e4b5e21c89b2a41e115
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.12.112 with commit 4468df5bcdef959fd96494e9968f323561a45f4c
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.18.55 with commit e2ee0616260080376123997488b5cf8a3870b8d9
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 7.2.9 with commit b36d32f30c3f1e58e3a5ae79d0f52836a316b36e
	Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 7.3-rc5 with commit 58eb1b3325edac42dc6df72c80962bd53a3c8ca7

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98524
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/rds/ib_frmr.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59
	https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8
	https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90
	https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115
	https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c
	https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9
	https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e
	https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7