From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id A04653ACEE0 for ; Sun, 18 Oct 2026 15:25:38 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337144; cv=none; b=Y4IlViK8OceebBdlWAVO6kld8hur+oIfYVsI+qRFHE0c2rvIinmX2tdQZXAKpzqC9oPKNFQ8oi9mwzvK5xj8EY4QT03UHFDYG2U4h0mOrn+R3SAKitXlCQPk1OAyfwHyGphfCNPNVNU/lNWhlgAO14U6WlAYIYFXN7qrxUNOLl0= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792337144; c=relaxed/simple; bh=6DVHBbF642GqBWq4O/Q9nprjU/NQ0p7HIIJEAeW97AM=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=mgRKjZpvGElsapwM8rRHUp6bAEcZ+uSWMD3QefJCPC9O1bcqBO6gq/dzeBfMwAIO2/ItyMMKIvcc0dxz8BkgrQR4BTnrMhTr7OJhLJcS7tGqKL34pWZUa8F/3rcS9GQd4RdfUWf/e07bbNxVFd/bUOQhJkGV3AYLiGlJmMMQfe8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=nKE7NT12; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="nKE7NT12" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 992341F000C6; Sun, 18 Oct 2026 15:25:37 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1792337138; bh=NGUkMiUtDaBl9qyDF5GnsOo4FlDBaZZZZ39S24gkIfQ=; h=From:To:Cc:Subject:Date:Reply-To; b=nKE7NT12y5w7Cd4fbbzrqczc1ibJ0+47aM5ua9o+8KvS9s70kFrRdv/aEitQQihdz gmBV1XeakM78H1MrqKWzEn5FnM6q9pzxjF8/YHHVfXsmtbpdTTtyzKFFVGdxEsQ+5q E7wOd/N1IxR32+URRR8Lmo+IpfTZbNuTipqv5iPE= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98524: rds: ib: Clear the sg list when mapping an MR fails Date: Sun, 18 Oct 2026 17:16:28 +0200 Message-ID: <2026101823-CVE-2026-98524-ce1e@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4082; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=MOAcxT+RjtulSNPsT7kXvT/DliI4q0ZwBcJ7k28yA2U=; b=owGbwMvMwCRo6H6F97bub03G02pJDFlXHnXv4uy2WSTsuOn1pP7Q7GNTL2r4Sq3dfaTCLGom8 9Ya/TtJHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjCRj78ZFmzW41ionLkscJr7 W9FwpTV9Rg/K9zAsaJK+mJvRrvH4TP2SA1Wzujfc5YvWBwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning. The Linux kernel CVE team has assigned CVE-2026-98524 to this issue. Affected and fixed versions =========================== Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 5.10.271 with commit 1be3211e6ac77adbb1eac01314d989d243b32c59 Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 5.15.222 with commit c42d316163f89cd23de2f3e24558177a8c29bad8 Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.1.189 with commit 8dca3c81344532a7f05edb3d12f31f3009410a90 Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.6.158 with commit 49ba5ed0129906e0362c2e4b5e21c89b2a41e115 Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.12.112 with commit 4468df5bcdef959fd96494e9968f323561a45f4c Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 6.18.55 with commit e2ee0616260080376123997488b5cf8a3870b8d9 Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 7.2.9 with commit b36d32f30c3f1e58e3a5ae79d0f52836a316b36e Issue introduced in 4.6 with commit 1659185fb4d0025835eb2058a141f0746c5cab00 and fixed in 7.3-rc5 with commit 58eb1b3325edac42dc6df72c80962bd53a3c8ca7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98524 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/rds/ib_frmr.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59 https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8 https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90 https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115 https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9 https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7