7.8

CVE-2026-43494: net/rds: reset op_nents when zerocopy page pin fails

Modified
AliasesUBUNTU-CVE-2026-43494DEBIAN-CVE-2026-43494
Published 21-05-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-43494 is a high (CVSS 7.8) Double Free vulnerability in linux. EPSS estimates a 0.41% chance of exploitation in the next 30 days, higher than 35.4% of scored vulnerabilities. 1 public exploit is recorded.

Priority
Prioritisepublic exploit

Public exploit (GitHub, Date unknown)

Source freshness unavailable

How is this decided?
CVSS score
7.8/10
010
High · v3.1 (CVE.org)
EPSS score
0.41%
0%100%
Low · +0.22 pp in 30 days
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github

Advisory lineage

Upstream 0 · Downstream 138 · Related 142
OPENSUSE-SU-2026:10954-1SUSE-SU-2026:21834-1SUSE-SU-2026:2195-1SUSE-SU-2026:2238-1SUSE-SU-2026:22598-1SUSE-SU-2026:22673-1

Showing 100 of 142.

Timeline

  1. 21-05-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

CVSS metrics

5 scores · 4 sources · 2 versions

EPSS trend

Probability

0.41%

Chance of exploitation in the next 30 days

Percentile

35%

Versus all other CVEs

30-day change

Increase +0.22 pp

From 0.19% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

1 found
  • githubUnverified

    Pocs

    Maturity: poc

Weaknesses

CWE · root cause

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu154 products
  • linux< 5.4.0-231.251 | < 5.15.0-181.191 | < 6.8.0-124.124 | < 6.17.0-35.35 | < 7.0.0-22.22
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-aws< 5.4.0-1160.170 | < 5.15.0-1109.116 | < 6.8.0-1057.60 | < 6.17.0-1017.17 | < 7.0.0-1006.6
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Linux2 products
  • linux≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < c6e51512a784c4a7b86e1a044988696e3b3721fa | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 03014551938a0887fa55f18ce49b70158a9c0113 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < d84ce1786ce40fdd3dd98db47aec5527817e1ef6 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 9115669faedccdda100428e2d26fd0aac8c50799 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 0bbbff00a15b1df2cac9014d6cf4b6890f473353 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 640e37f58f991546a87540d067279c2c1fa9fe51 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 290e833d1acb1093bc121fcdc97f5e6161157479 | ≥ 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < e174929793195e0cd6a4adb0cad731b39f9019b4 | 4.17
  • linux_kernel≥ 4.17, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.141 | ≥ 6.7, < 6.12.91 | ≥ 6.13, < 6.18.33 | ≥ 6.19, < 7.0.10 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3
Debian1 product
  • linux< 6.1.176-1 | < 6.12.90-2 | < 7.0.10-1

3 vendors · 157 products

References

39 links
Show all 39 references