CVE-2026-98524

In the Linux kernel, the following vulnerability has been resolved:

rds: ib: Clear the sg list when mapping an MR fails

rds ib map frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rds rdma map() unpins the pages and frees the scatterlist, but rds ib free frmr() can still return the MR to the pool with the stale pointer set.

This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down:

BUG: KASAN: slab-use-after-free in rds ib teardown mr Read of size 8

Call Trace: rds ib teardown mr rds ib unreg frmr rds ib flush mr pool rds ib flush mrs rds free mr rds setsockopt

Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.