UBUNTU-CVE-2026-98366: Use After Free

In the Linux kernel, the following vulnerability has been resolved: RDMA/rxe: validate access flags before swapping the MR's PD rxereregusermr() reassigns mr->ibmr.pd first and only then validates the IBMRREREGACCESS argument: if (flags & IBMRREREGPD) { rxeput(oldpd); rxeget(pd); mr->ibmr.pd = ibpd; } if (flags & IBMRREREGACCESS) { if (access & ~RXEACCESSSUPPORTEDMR) return ERRPTR(-EOPNOTSUPP); mr->access = access; } Both flags pass the entry check because RXEMRREREGSUPPORTED is IBMRREREGPD | IBMRREREGACCESS, so a caller can reach the access check with mr->ibmr.pd already reassigned. mr->ibmr.pd is owned by the core, which adjusts pd->usecnt only on the success path: ibuverbsreregmr() jumps to putnewuobj on a driver error without undoing the reassignment, so mr->pd == newpd while the usecnts still charge the MR to origpd. ibderegmruser() then decrements newpd, whose count can reach zero while a memory window still references it; uverbsfreepd() frees the PD on that count alone and rxemwcleanup() writes to freed memory: BUG: KASAN: slab-use-after-free in rxeput+0x31/0xa0 Write of size 4 at addr ffff8881301dd690 by task rxepoc/591 rxeput+0x31/0xa0 rxemwcleanup+0x42/0x200 rxecleanup+0x115/0x370 rxedeallocmw+0x4c/0x80 Allocated by task 591: ibuverbsallocpd+0x258/0x540 Freed by task 591: ibdeallocpduser+0x174/0x210 uverbsfreepd+0x8d/0xc0 ibuverbsdeallocpd+0x18e/0x1d0 Validate the access flags before mutating any state so the callback either applies every requested change or none.