UBUNTU-CVE-2026-98524: Use After Free

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rdsibmapfrmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, rdsrdmamap() unpins the pages and frees the scatterlist, but rdsibfreefrmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in rdsibteardownmr Read of size 8 Call Trace: rdsibteardownmr rdsibunregfrmr rdsibflushmrpool rdsibflushmrs rdsfreemr rdssetsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.