CVE-2026-43494

net/rds: reset op_nents when zerocopy page pin fails

State: Published
Severity: 7.8 High
Published: May 21, 2026
Updated: Oct 19, 2026
Reserved: May 1, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: reset op_nents when zerocopy page pin fails

When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents.

Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again.

Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux
3.1	7.0 High	CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H	redhat-SADP

Weaknesses

CWE-1341 Multiple Releases of Same Resource or Handle
CWE-415 Double Free

Affected Products

Product	Versions
LinuxLinux	0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before c6e51512a784c4a7b86e1a044988696e3b3721faAffected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 03014551938a0887fa55f18ce49b70158a9c0113Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before d84ce1786ce40fdd3dd98db47aec5527817e1ef6Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 9115669faedccdda100428e2d26fd0aac8c50799Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 0bbbff00a15b1df2cac9014d6cf4b6890f473353Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 640e37f58f991546a87540d067279c2c1fa9fe51Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 290e833d1acb1093bc121fcdc97f5e6161157479Affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before e174929793195e0cd6a4adb0cad731b39f9019b4Affected
LinuxLinux	4.17Affected before 4.17Not affected 5.10.258 through 5.10.Not affected 5.15.209 through 5.15.Not affected 6.1.175 through 6.1.Not affected 6.6.141 through 6.6.Not affected 6.12.91 through 6.12.Not affected 6.18.33 through 6.18.Not affected 7.0.10 through 7.0.*Not affected 7.1 and laterNot affected

Product

Versions

LinuxLinux

0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before c6e51512a784c4a7b86e1a044988696e3b3721faAffected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 03014551938a0887fa55f18ce49b70158a9c0113Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before d84ce1786ce40fdd3dd98db47aec5527817e1ef6Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 9115669faedccdda100428e2d26fd0aac8c50799Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 0bbbff00a15b1df2cac9014d6cf4b6890f473353Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 640e37f58f991546a87540d067279c2c1fa9fe51Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before 290e833d1acb1093bc121fcdc97f5e6161157479Affected
0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 to before e174929793195e0cd6a4adb0cad731b39f9019b4Affected

LinuxLinux

4.17Affected
before 4.17Not affected
5.10.258 through 5.10.*Not affected
5.15.209 through 5.15.*Not affected
6.1.175 through 6.1.*Not affected
6.6.141 through 6.6.*Not affected
6.12.91 through 6.12.*Not affected
6.18.33 through 6.18.*Not affected
7.0.10 through 7.0.*Not affected
7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.