CVE-2026-98524 (GCVE-0-2026-98524)

Vulnerability from cvelistv5 – Published: 2026-10-18 15:17 – Updated: 2026-10-24 14:09
VLAI
Title
rds: ib: Clear the sg list when mapping an MR fails
Summary
In the Linux kernel, the following vulnerability has been resolved: rds: ib: Clear the sg list when mapping an MR fails rds_ib_map_frmr() stores the caller's scatterlist in the MR before DMA mapping and registration can fail. On failure, __rds_rdma_map() unpins the pages and frees the scatterlist, but rds_ib_free_frmr() can still return the MR to the pool with the stale pointer set. This leaves the pool with a dangling scatterlist and can lead to local privilege escalation. KASAN detects the resulting use-after-free when the MR is later torn down: BUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr Read of size 8 Call Trace: __rds_ib_teardown_mr rds_ib_unreg_frmr rds_ib_flush_mr_pool rds_ib_flush_mrs rds_free_mr rds_setsockopt Store the scatterlist in the MR only after DMA mapping succeeds. If DMA mapping fails, return directly while the MR fields remain clear; the caller keeps ownership of the scatterlist and its pinned pages. If a later registration step fails, unmap the scatterlist and clear the MR fields before returning.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
Linux CNA under the mitre root
CNA scorecard D 53/100 over 6848 records in the last 180 days details
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < 1be3211e6ac77adbb1eac01314d989d243b32c59 (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < c42d316163f89cd23de2f3e24558177a8c29bad8 (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < 8dca3c81344532a7f05edb3d12f31f3009410a90 (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < 49ba5ed0129906e0362c2e4b5e21c89b2a41e115 (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < 4468df5bcdef959fd96494e9968f323561a45f4c (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < e2ee0616260080376123997488b5cf8a3870b8d9 (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < b36d32f30c3f1e58e3a5ae79d0f52836a316b36e (git)
Affected: 1659185fb4d0025835eb2058a141f0746c5cab00 , < 58eb1b3325edac42dc6df72c80962bd53a3c8ca7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.6
Unaffected: 0 , < 4.6 (semver)
Unaffected: 5.10.271 , ≤ 5.10.* (semver)
Unaffected: 5.15.222 , ≤ 5.15.* (semver)
Unaffected: 6.1.189 , ≤ 6.1.* (semver)
Unaffected: 6.6.158 , ≤ 6.6.* (semver)
Unaffected: 6.12.112 , ≤ 6.12.* (semver)
Unaffected: 6.18.55 , ≤ 6.18.* (semver)
Unaffected: 7.2.9 , ≤ 7.2.* (semver)
Unaffected: 7.3 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib_frmr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "1be3211e6ac77adbb1eac01314d989d243b32c59",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "c42d316163f89cd23de2f3e24558177a8c29bad8",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "8dca3c81344532a7f05edb3d12f31f3009410a90",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "49ba5ed0129906e0362c2e4b5e21c89b2a41e115",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "4468df5bcdef959fd96494e9968f323561a45f4c",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "e2ee0616260080376123997488b5cf8a3870b8d9",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "b36d32f30c3f1e58e3a5ae79d0f52836a316b36e",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            },
            {
              "lessThan": "58eb1b3325edac42dc6df72c80962bd53a3c8ca7",
              "status": "affected",
              "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/rds/ib_frmr.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.6"
            },
            {
              "lessThan": "4.6",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.271",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.222",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.158",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.112",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.55",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.271",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.222",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.189",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.158",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.112",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.55",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2.9",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.3",
                  "versionStartIncluding": "4.6",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller\u0027s scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The attacker reaches patched rds_ib_map_frmr() through sendmsg() with a local RDS_CMSG_RDMA_MAP control message; no RDS packet field from a remote peer supplies the scatterlist or faulty ownership state.\nAC:L - On HNS hardware, the attacker can start an outgoing RDS connection and retry sendmsg() while its QP is RESET/INIT/RTR; check_send_valid() makes hns_roce_v2_post_send() return -EINVAL to rds_ib_post_reg_frmr(), creating the required failure.\nPR:L - rds_create(), rds_bind(), and rds_sendmsg() impose no capability or authentication check, and __rds_rdma_map() accepts an unprivileged process whenever can_do_mlock() sees a nonzero RLIMIT_MEMLOCK; RDS/IB merely requires the host\u0027s initial network namespace.\nUI:N - The attacking process performs both RDS_CMSG_RDMA_MAP and the zero-cookie setsockopt(SOL_RDS, RDS_FREE_MR) that calls rds_ib_flush_mrs(); no victim action is required.\nS:U - The stale ibmr-\u003esg is consumed by __rds_ib_teardown_mr() within the host kernel, so exploitation elevates authority inside that same kernel rather than crossing a VM, IOMMU, or other security boundary.\nC:H - __rds_ib_teardown_mr() obtains page pointers with sg_page() from a freed, reclaimable scatterlist; attacker-controlled reclamation and the subsequent invalid free can enable kernel-memory compromise and disclosure.\nI:H - Teardown passes page pointers taken from the stale scatterlist to unpin_user_pages_dirty_lock() and then kfree()s the already-freed or reallocated array, enabling page-refcount and heap corruption usable for arbitrary writes or control-flow takeover.\nA:H - The observed slab use-after-free occurs in __rds_ib_teardown_mr(); dereferencing an invalid sg_page(), unpinning the resulting bogus page, or freeing the dangling scatterlist can produce a kernel oops or panic."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-10-24T14:09:17.970Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59"
        },
        {
          "url": "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8"
        },
        {
          "url": "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90"
        },
        {
          "url": "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115"
        },
        {
          "url": "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c"
        },
        {
          "url": "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9"
        },
        {
          "url": "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e"
        },
        {
          "url": "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7"
        }
      ],
      "title": "rds: ib: Clear the sg list when mapping an MR fails",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-98524",
    "datePublished": "2026-10-18T15:17:41.420Z",
    "dateReserved": "2026-09-25T10:25:14.355Z",
    "dateUpdated": "2026-10-24T14:09:17.970Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-98524",
      "date": "2026-11-03",
      "epss": "0.00171",
      "percentile": "0.06521"
    },
    "microsoft_vex": {
      "current_release_date": "2026-11-02T01:45:36.000Z",
      "cve": "CVE-2026-98524",
      "id": "msrc_CVE-2026-98524",
      "initial_release_date": "2026-10-20T01:09:40.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "rds: ib: Clear the sg list when mapping an MR fails",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-98524.json",
      "version": "5"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/rds/ib_frmr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "1be3211e6ac77adbb1eac01314d989d243b32c59",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c42d316163f89cd23de2f3e24558177a8c29bad8",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "8dca3c81344532a7f05edb3d12f31f3009410a90",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "49ba5ed0129906e0362c2e4b5e21c89b2a41e115",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4468df5bcdef959fd96494e9968f323561a45f4c",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "e2ee0616260080376123997488b5cf8a3870b8d9",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b36d32f30c3f1e58e3a5ae79d0f52836a316b36e",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "58eb1b3325edac42dc6df72c80962bd53a3c8ca7",
                    "status": "affected",
                    "version": "1659185fb4d0025835eb2058a141f0746c5cab00",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/rds/ib_frmr.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.6"
                  },
                  {
                    "lessThan": "4.6",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.271",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.222",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.189",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.158",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.112",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.55",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.2.*",
                    "status": "unaffected",
                    "version": "7.2.9",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.3",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nrds: ib: Clear the sg list when mapping an MR fails\n\nrds_ib_map_frmr() stores the caller\u0027s scatterlist in the MR before DMA\nmapping and registration can fail. On failure, __rds_rdma_map() unpins\nthe pages and frees the scatterlist, but rds_ib_free_frmr() can still\nreturn the MR to the pool with the stale pointer set.\n\nThis leaves the pool with a dangling scatterlist and can lead to local\nprivilege escalation. KASAN detects the resulting use-after-free when the\nMR is later torn down:\n\nBUG: KASAN: slab-use-after-free in __rds_ib_teardown_mr\nRead of size 8\n\nCall Trace:\n __rds_ib_teardown_mr\n rds_ib_unreg_frmr\n rds_ib_flush_mr_pool\n rds_ib_flush_mrs\n rds_free_mr\n rds_setsockopt\n\nStore the scatterlist in the MR only after DMA mapping succeeds. If DMA\nmapping fails, return directly while the MR fields remain clear; the caller\nkeeps ownership of the scatterlist and its pinned pages. If a later\nregistration step fails, unmap the scatterlist and clear the MR fields\nbefore returning."
          }
        ],
        "id": "CVE-2026-98524",
        "lastModified": "2026-10-24T14:16:46.107",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-10-18T16:17:03.827",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1be3211e6ac77adbb1eac01314d989d243b32c59"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/4468df5bcdef959fd96494e9968f323561a45f4c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/49ba5ed0129906e0362c2e4b5e21c89b2a41e115"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/58eb1b3325edac42dc6df72c80962bd53a3c8ca7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/8dca3c81344532a7f05edb3d12f31f3009410a90"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/b36d32f30c3f1e58e3a5ae79d0f52836a316b36e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c42d316163f89cd23de2f3e24558177a8c29bad8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/e2ee0616260080376123997488b5cf8a3870b8d9"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-10-31T07:30:14+00:00",
      "cve": "CVE-2026-98524",
      "id": "CVE-2026-98524",
      "initial_release_date": "2026-10-18T00:00:00+00:00",
      "product_status:known_not_affected": "279",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: rds: ib: Clear the sg list when mapping an MR fails",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-98524.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-10-22T23:47:44Z",
      "cve": "CVE-2026-98524",
      "id": "CVE-2026-98524",
      "initial_release_date": "2026-10-18T23:45:36Z",
      "product_status:known_affected": "342",
      "product_status:known_not_affected": "6",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-98524",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/2026/cve-2026-98524.json",
      "version": "5"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.