CVE-2026-43120

RDMA/irdma: Fix double free related to rereg_user_mr

State: Published
Severity: 7.8 High
Published: May 6, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix double free related to rereg_user_mr

If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again.

Fix this by setting iwmr->region to NULL after ib_umem_release.

Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 to before 62298a48f8b8788ad8b8464e6ffdf1ddebd2217eAffected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 66964118f1f50ed85001c8fc9f7ab5bbdd021ee0Affected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 0f22c32141acdcda266b26cab2b830baf870f3e0Affected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 0c5d70bcb9d2275a1c8515a924016fcfeb4ab441Affected 5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2Affected 6.6.120 to before 6.6.136Affected
LinuxLinux	6.7Affected before 6.7Not affected 6.6.136 through 6.6.Not affected 6.12.83 through 6.12.Not affected 6.18.24 through 6.18.Not affected 6.19.14 through 6.19.Not affected 7.0 and laterNot affected

Product

Versions

LinuxLinux

715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 to before 62298a48f8b8788ad8b8464e6ffdf1ddebd2217eAffected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 66964118f1f50ed85001c8fc9f7ab5bbdd021ee0Affected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 0f22c32141acdcda266b26cab2b830baf870f3e0Affected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 0c5d70bcb9d2275a1c8515a924016fcfeb4ab441Affected
5ac388db27c443dadfbb0b8b23fa7ccf429d901a to before 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2Affected
6.6.120 to before 6.6.136Affected

LinuxLinux

6.7Affected
before 6.7Not affected
6.6.136 through 6.6.*Not affected
6.12.83 through 6.12.*Not affected
6.18.24 through 6.18.*Not affected
6.19.14 through 6.19.*Not affected
7.0 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.