Linux kernel rds/ib: stale scatterlist after failed MR registration gives a use-after-free on teardown

Impact

rds_ib_map_frmr() stored the caller's scatterlist in the memory region before DMA mapping and registration could fail. On failure the caller unpins the pages and frees the scatterlist, but the MR goes back into the pool still holding the pointer, so the pool carries a dangling scatterlist that is dereferenced when the MR is later flushed and torn down. The kernel's own report describes this as leading to local privilege escalation, with KASAN catching the use-after-free on the rds_free_mr path reached from setsockopt(). This matters on GPU nodes specifically because the vulnerable registration path only runs on hosts with an InfiniBand or RoCE HCA - the same ConnectX-class fabric that GPU clusters are built on - and because on many distro kernels the rds module is autoloaded the moment any unprivileged local user creates an AF_RDS socket, so the attack surface is present even on fleets where nobody deliberately runs RDS.

Who can reach it

Local, unauthenticated beyond having a shell or a pod on the node: an ordinary user opens an AF_RDS socket and drives MR registration through rds_setsockopt. The node must have an IB or RoCE device for the frmr path, and the rds module must be loadable - which on a stock distro kernel it is, via socket-family autoload.

What to do

Update to a stable kernel carrying the fix and reboot each affected node; the change is in-kernel with no userspace component. Where a reboot cannot be scheduled immediately, blacklisting the module (an rds entry in modprobe.d plus install rds /bin/false) removes the surface on any node that has not already loaded it, and costs nothing on fleets that do not use RDS - verify with lsmod | grep rds first.

References

Related entries

• Linux kernel BPF verifier: missed zero-extension marking lets a loaded program inject arbitrary register upper halvesCVE-2026-98869 · Linux kernel BPF verifier (32-bit subregister zero-extension / zext_dst inference)High
• drm/vmwgfx: unvalidated pitch in cursor snooping allows out-of-bounds reads in a VMware guestCVE-2026-99002 · Linux kernel drm/vmwgfx (cursor snooping, unvalidated userspace pitch)High
• Linux net/smc: use-after-free on the CLC socket in smc_getname during link-group terminationCVE-2026-99032 · Linux kernel net/smc (smc_getname clcsock lifetime)High
• KVM SEV: unlocked set_page_dirty on get_user_pages_fast pages during guest memory populationCVE-2026-99177 · Linux kernel KVM SEV (sev_gmem_post_populate guest-memory population)High
• Linux kernel io_uring/waitid: repeated failed cancellations wrap the reference counter and double-complete a requestCVE-2026-99227 · Linux kernel io_uring waitid (31-bit cancel reference counter wrap)High
• Linux kernel io_uring/waitid: use-after-free when the wake handler clears ->head before owning the requestCVE-2026-99231 · Linux kernel io_uring waitid (use-after-free via ->head cleared before ownership)High