---
id: CVE-2026-98524
title: 'kernel: rds: ib: Clear the sg list when mapping an MR fails (CVE-2026-98524)'
summary: >-
  A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS)
  subsystem. When memory region mapping fails during InfiniBand operations, the
  kernel can retain a stale reference to memory buffers that have already been
  released. A l…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: vendor
cwe: CWE-825
vendor: Red Hat
product: Linux
affected:
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    1be3211e6ac77adbb1eac01314d989d243b32c59
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    c42d316163f89cd23de2f3e24558177a8c29bad8
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    8dca3c81344532a7f05edb3d12f31f3009410a90
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    49ba5ed0129906e0362c2e4b5e21c89b2a41e115
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    4468df5bcdef959fd96494e9968f323561a45f4c
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    e2ee0616260080376123997488b5cf8a3870b8d9
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    b36d32f30c3f1e58e3a5ae79d0f52836a316b36e
  - >-
    Linux >= 1659185fb4d0025835eb2058a141f0746c5cab00 <
    58eb1b3325edac42dc6df72c80962bd53a3c8ca7
  - Linux 4.6
published: '2026-10-18'
updated: '2026-10-24'
sourceUpdated: '2026-10-24T14:22:48+00:00'
source: CSAF
sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98524.json'
references:
  - url: >-
      https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98524.json
  - url: 'https://access.redhat.com/security/cve/CVE-2026-98524'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2555039'
  - url: 'https://www.cve.org/CVERecord?id=CVE-2026-98524'
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-98524'
  - url: >-
      https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98524.mbox
  - url: 'https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59'
  - url: 'https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8'
  - url: 'https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90'
  - url: 'https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115'
  - url: 'https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c'
  - url: 'https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9'
  - url: 'https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e'
  - url: 'https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7'
tags:
  - csaf
  - vex
  - red-hat
  - cve.org
epss: 0.00171
epssPercentile: 0.06466
ingestedAt: '2026-10-18T15:45:12.281Z'
---

## Overview

A flaw was found in the Linux kernel's Reliable Datagram Sockets (RDS) subsystem. When memory region mapping fails during InfiniBand operations, the kernel can retain a stale reference to memory buffers that have already been released. A local attacker could exploit this flaw to trigger a use-after-free condition, potentially leading to local privilege escalation or a denial of service through a system crash.

## Vendor advisories

- **Red Hat VEX** · Important · updated 2026-10-24 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98524.json)

**kernel: rds: ib: Clear the sg list when mapping an MR fails** — rated Important by Red Hat. Released 2026-10-18, updated 2026-10-24.

Not affected:

- Red Hat Enterprise Linux 10
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat OpenShift Container Platform 4

## Remediation

Refer to the advisory for fix availability.