A flaw in the Linux kernel’s Remote Direct Memory Access driver for InfiniBand (rds_ib) causes a use‑after‑free when a memory registration fails after the driver has stored the caller’s scatterlist. The scatterlist remains in the memory registration (MR) pool even after the registration is invalidated, so a later teardown of that MR accesses freed memory. An attacker can trigger this scenario and execute privileged code inside the kernel, thereby escalating local privileges.

The vulnerability exists in any Linux kernel image that compiles the rds_ib module and has not yet incorporated the rds_ib_map_frmr fix. No specific kernel release is cited; therefore, all distributions using an unpatched rds_ib module are potentially affected until they update their kernel.

The CVSS score is not supplied and EPSS is unavailable, but the impact is high: successful exploitation results in kernel‑level code execution. Exploitation requires a process with sufficient privileges to interact with the rds driver, such as setting socket options on an RDS socket. The likely attack vector is a local compromise or privilege escalation from a user‑level process that can load or unload the module or otherwise cause the failing cleanup path.