CVE-2026-43502

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to May 2026

Description An out-of-bounds memory buffer operation exists in the rds message purge() function. The issue occurs during a zerocopy send failure after user pages are pinned but before the message is attached to the sending socket. The purge path incorrectly infers the zerocopy state from rm->m rs, causing unqueued messages to be cleaned up as if they owned normal payload pages. In reality, zerocopy ownership is determined by the presence of op mmp znotifier. This flaw can be exploited remotely to impact the confidentiality, integrity, and availability of protected information. This issue was discovered and exploited by the NebuSec security pipeline.

Recommendations Update the Linux kernel to the version released in May 2026 or later. As a temporary mitigation, restrict the use of the rds message purge() function.