CVE-2026-98524: Software Security Vulnerability Vulnerability

UNKNOWN
Advisory Identifier: GHSA-wq82-wxrv-wcj7
Share
Published
Advisory Summary

CVE-2026-98524 is a security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-98524 at a Glance

CVE Identifier CVE-2026-98524
GHSA Identifier GHSA-wq82-wxrv-wcj7
Severity N/A
CVSS v3.1 Base Score N/A
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

How to Fix CVE-2026-98524

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-98524, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.

References

NVD — CVE-2026-98524 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-98524
git.kernel.org/stable/c/1be3211e6a... WEB
https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59
git.kernel.org/stable/c/4468df5bcd... WEB
https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c
git.kernel.org/stable/c/49ba5ed012... WEB
https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115
git.kernel.org/stable/c/58eb1b3325... WEB
https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7
git.kernel.org/stable/c/8dca3c8134... WEB
https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90
git.kernel.org/stable/c/b36d32f30c... WEB
https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e
git.kernel.org/stable/c/c42d316163... WEB
https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8
git.kernel.org/stable/c/e2ee061626... WEB
https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9

Frequently Asked Questions

What is CVE-2026-98524?
CVE-2026-98524 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-98524?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What CWE is associated with CVE-2026-98524?
CVE-2026-98524 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-98524?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-wq82-wxrv-wcj7",
  "modified" : "2026-10-18T18:31:52Z",
  "published" : "2026-10-18T18:31:52Z",
  "aliases" : [ "CVE-2026-98524" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning.",
  "severity" : [ ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-98524"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : null,
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-10-18T16:17:03Z"
  }
}