Linux Kernel: RDS op_nents double free on zerocopy fail
CVE-2026-43494 Published on May 21, 2026
net/rds: reset op_nents when zerocopy page pin fails
In the Linux kernel, the following vulnerability has been resolved:
net/rds: reset op_nents when zerocopy page pin fails
When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),
the pinned pages are released with put_page(), and
rm->data.op_mmp_znotifier is cleared. But we fail to properly
clear rm->data.op_nents.
Later when rds_message_purge() is called from rds_sendmsg() the
cleanup loop iterates over the incorrectly non zero number of
op_nents and frees them again.
Fix this by properly resetting op_nents when it should be in
rds_message_zcopy_from_user().
Products Associated with CVE-2026-43494
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 and below e174929793195e0cd6a4adb0cad731b39f9019b4 is affected.
- Version 4.17 is affected.
- Before 4.17 is unaffected.
- Version 7.1-rc4, <= * is unaffected.