CVE-2026-43128

HIGH EPSS 3.6%
Published May 6, 20261mo ago · Modified Jun 17, 20261w ago
7.8 CVSS 3.1
High
Find Similar
Published May 6, 2026 1mo ago
Last Modified Jun 17, 2026 1w ago

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).

CVSS Details

Base Score
7.8
Exploitability
1.8
Impact
5.9
Vector string
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack Vector Local
Attack Complexity Low
Privileges Required Low
User Interaction None
Scope Unchanged
Confidentiality High
Integrity High
Availability High

Threat Intelligence

EPSS Exploit Probability
3.6% percentile
Exploit & Patch Status
No Known Exploit
Patch Available

Weaknesses 1

CWE-415

Affected Products 6

VendorProductVersionRange
linuxlinux_kernel*≥5.16  –  <6.1.165
linuxlinux_kernel*≥6.2  –  <6.6.128
linuxlinux_kernel*≥6.7  –  <6.12.75
linuxlinux_kernel*≥6.13  –  <6.18.16
linuxlinux_kernel*≥6.19  –  <6.19.6
linuxlinux_kernel7.0any

References 6

  • git.kernel.org https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
    Patch

Remediation

  • git.kernel.org https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4
    Patch
  • git.kernel.org https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
    Patch