CVE-2026-43502

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge(...

Affected product and versions

Product

Linux Linux, linux kernel

Affected versions

>= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < e9aefdc5c53fe9aed108c14e3d155710a1bb14c9, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 46662f7dc59475995609bf3e9d27eb36f4acf26f, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 1e262db7675e27f42c3f3f47d6011855f4454f24, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 3abc8983b2bae3f487f77d9da5527d7d6b210d46, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 14ef6fd18db2494098b21e0471bf27a1d8e9993e, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b, >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 44b550d88b267320459d518c0743a241ab2108fa, >= 4.17, >= 4.17 < 5.10.258, >= 5.11 < 5.15.209, >= 5.16 < 6.1.175, >= 6.2 < 6.6.140, >= 6.7 < 6.12.88, >= 6.13 < 6.18.30, >= 6.19 < 7.0.7, 7.1

Fixed versions

5.10.258, 5.15.209, 6.1.175, 6.6.140, 6.12.88, 6.18.30, 7.0.7

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE

Not available