net/rds: reset op_nents when zerocopy page pin fails

Summary

CVE	CVE-2026-43494
State	PUBLISHED
Assigner	Linux
Source Priority	CVE Program / NVD first with legacy fallback
Published	2026-05-21 12:16:19 UTC
Updated	2026-07-15 02:21:44 UTC
Description	In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

Risk And Classification

Primary CVSS: v3.1 7 HIGH from ADP

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS: 0.002100000 probability, percentile 0.111960000 (date 2026-06-18)

Problem Types: NVD-CWE-noinfo | CWE-1341 | CWE-1341 Multiple Releases of Same Resource or Handle

Version	Source	Type	Score	Severity	Vector
3.1	ADP	CVSS	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	416baaa9-dc9f-4396-8d5f-8c081fb06d67	Secondary	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	Secondary	7	HIGH	`CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H`
3.1	CNA	DECLARED	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`

CVSS v3.1 Breakdown

Attack Vector

Local

Attack Complexity

High

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

NVD Known Affected Configurations (CPE 2.3)

Type	Vendor	Product	Version	Update	Edition	Language
Operating System	Linux	Linux Kernel	All	All	All	All

Vendor Declared Affected Products

Source	Vendor	Product	Version	Platforms
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 c6e51512a784c4a7b86e1a044988696e3b3721fa git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 03014551938a0887fa55f18ce49b70158a9c0113 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 d84ce1786ce40fdd3dd98db47aec5527817e1ef6 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 9115669faedccdda100428e2d26fd0aac8c50799 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 0bbbff00a15b1df2cac9014d6cf4b6890f473353 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 640e37f58f991546a87540d067279c2c1fa9fe51 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 290e833d1acb1093bc121fcdc97f5e6161157479 git	Not specified
CNA	Linux	Linux	affected 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 e174929793195e0cd6a4adb0cad731b39f9019b4 git	Not specified
CNA	Linux	Linux	affected 4.17	Not specified
CNA	Linux	Linux	unaffected 4.17 semver	Not specified
CNA	Linux	Linux	unaffected 5.10.258 5.10.* semver	Not specified
CNA	Linux	Linux	unaffected 5.15.209 5.15.* semver	Not specified
CNA	Linux	Linux	unaffected 6.1.175 6.1.* semver	Not specified
CNA	Linux	Linux	unaffected 6.6.141 6.6.* semver	Not specified
CNA	Linux	Linux	unaffected 6.12.91 6.12.* semver	Not specified
CNA	Linux	Linux	unaffected 6.18.33 6.18.* semver	Not specified
CNA	Linux	Linux	unaffected 7.0.10 7.0.* semver	Not specified
CNA	Linux	Linux	unaffected 7.1 * original_commit_for_fix	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 10	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 6	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 7	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 8	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified
ADP	Red Hat	Red Hat Enterprise Linux 9	Not specified	Not specified

References

Reference	Source	Link	Tags
git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	security.access.redhat.com
bugzilla.redhat.com/show_bug.cgi	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	bugzilla.redhat.com
git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
github.com/v12-security/pocs/tree/main/pintheft	416baaa9-dc9f-4396-8d5f-8c081fb06d67	github.com	Exploit, Third Party Advisory
git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa	416baaa9-dc9f-4396-8d5f-8c081fb06d67	git.kernel.org	Patch
access.redhat.com/security/cve/CVE-2026-43494	0b0ca135-0b70-47e7-9f44-1890c2a1c46c	access.redhat.com
www.openwall.com/lists/oss-security/2026/05/21/2	af854a3a-2127-422b-91ae-364da2661108	www.openwall.com	Mailing List
CVE Program record	CVE.ORG	www.cve.org	canonical
NVD vulnerability detail	NVD	nvd.nist.gov	canonical, analysis

No vendor comments have been submitted for this CVE.

Additional Advisory Data

Source	Time	Event
ADP	2026-05-21T00:00:00.000Z	Reported to Red Hat.
ADP	2026-05-21T00:00:00.000Z	Made public.

There are currently no legacy QID mappings associated with this CVE.