CVE-2026-43494

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the net/rds module of the Linux kernel. The problem occurs when a zerocopy page pin operation fails within the rds message zcopy from user() function, specifically when iov iter get pages2() fails. In this scenario, while pinned pages are released and rm->data.op mmp znotifier is cleared, the memory management counter op nents is not correctly reset. Subsequently, when rds sendmsg() calls the rds message purge() function, the cleanup loop uses the incorrect non-zero value of op nents to release memory that has already been freed. A local attacker could exploit this to cause a system crash (denial of service), escalate privileges, or execute unauthorized code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. As a temporary workaround, consider restricting the use of the net/rds module to minimize the risk of exploitation.