In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the… (CVE-2026-98524)

The vulnerability in the Linux kernel involves the rds_ib_map_frmr() function, which stores the caller's scatterlist in the MR before DMA mapping and registration complete. If DMA mapping fails, the scatterlist is freed but the MR may still hold a stale pointer, resulting in a use-after-free condition. This dangling pointer can lead to local privilege escalation. The fix ensures the scatterlist is stored in the MR only after successful DMA mapping, and on failure, the MR fields remain clear while the caller retains ownership of the scatterlist and pinned pages.

This vulnerability can lead to local privilege escalation on affected Linux kernel systems by causing use-after-free conditions in the RDMA subsystem. It may allow a local attacker to execute code or escalate privileges due to improper memory handling in the rds_ib_map_frmr() function.

A fix has been implemented in the Linux kernel to address this issue by changing the order of operations in rds_ib_map_frmr(). Users should update to the patched kernel version containing this fix. No additional mitigation is required beyond applying the official patch.