Linux Kernel EUVD-2026-103569

Requires a local user able to open PF_RDS (AF_RDS) sockets on a kernel built with RDS RDMA support (CONFIG_RDS/CONFIG_RDS_RDMA) and the rds_rdma/ib path reachable, i.e., the RDS Infiniband transport in use. The specific trigger is a failure of DMA mapping or memory-region registration inside rds_ib_map_frmr(), after which rds_ib_free_frmr() returns the MR to the pool with a stale scatterlist; the use-after-free then fires during MR teardown (reachable via rds_free_mr from rds_setsockopt). Limiting factors: exploitation is local only (AV:L), needs an authenticated/unprivileged local account (PR:L), and depends on the non-default presence of the RDS-over-Infiniband subsystem - hosts without RDS or without the IB/RDMA transport are not exposed. Reliably driving the map/registration failure and grooming the freed object are additional practical hurdles not detailed in the sources.

This is a genuine local privilege-escalation primitive rather than a high-CVSS-but-low-risk issue, but its real-world urgency is tempered by narrow preconditions. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N) is internally consistent with the description: exploitation is local, low-complexity, and requires an authenticated (PR:L) unprivileged local account, with no user interaction and high confidentiality, integrity, and availability impact (C:H/I:H/A:H) reflecting a kernel use-after-free that can corrupt slab memory. EPSS is low at 0.22% (12th percentile), the CVE is NOT in CISA KEV, and no public exploit or PoC reference is present in the input - only upstream git.kernel.org patch commits and the NVD advisory. These signals are mutually consistent: a real, patchable kernel memory-safety bug with no evidence of weaponization. No SSVC decision fields (exploitation/automatable/technical-impact) were supplied; the vendor-priority 'this_week' label aligns with a serious-but-not-emergency local flaw. The key limiting factor not captured by the CVSS score is that the vulnerable path lives in the RDS-over-Infiniband (FRMR) code, which must be present and reachable for exploitation - a significant narrowing the raw 7.8 does not convey.

A local, unprivileged user on a Linux host with the RDS Infiniband module loaded creates an RDS socket and registers a memory region, deliberately driving the DMA mapping or registration in rds_ib_map_frmr() to fail. The failed MR is returned to the pool with a stale scatterlist pointer, and when the MR is later torn down (e.g., via rds_free_mr through setsockopt) the dangling pointer is dereferenced, yielding a use-after-free the attacker can groom toward kernel memory corruption and privilege escalation. No public exploit code is identified at time of analysis; the flaw was found via KASAN.