{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43120", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.987Z", "datePublished": "2026-05-06T07:40:43.923Z", "dateUpdated": "2026-08-05T12:26:04.967Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:04.967Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")" } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable path is reached through local RDMA uverbs operations on `/dev/infiniband/uverbs*`, specifically MR re-registration and deregistration. Remote RDMA/iWARP traffic does not invoke this userspace verbs callback.\nAC:L - No race or victim state is required; the same local process controls the MR, the `IB_MR_REREG_TRANS` request, and the subsequent deregistration that triggers the second release. Post-allocation failure can be induced through controlled MR parameters or irdma resource exhaustion, and uncertainty is resolved toward the higher severity option.\nPR:L - The attacker needs local access to an RDMA uverbs device and enough normal memlock allowance to register user memory, but the path does not require real root or administrative capabilities. RDMA core checks object ownership/netns access, not a high-privilege capability gate.\nUI:N - After obtaining local access, the attacker can issue the uverbs commands directly. No victim user action is required.\nS:U - The bug corrupts kernel memory within the same host kernel security authority. It is not a guest-to-host escape or other cross-scope boundary bypass.\nC:H - The stale `ib_umem` pointer creates a kernel heap use-after-free/double-free condition, and the second `ib_umem_release()` dereferences freed object fields. Such memory corruption can be leveraged for kernel information disclosure.\nI:H - The double release can corrupt allocator state and operate on attacker-reused `struct ib_umem` contents, providing a plausible path to arbitrary kernel memory corruption or code execution. Kernel UAF/double-free is therefore scored as high integrity impact.\nA:H - The second release of the same umem can crash or panic the kernel through invalid scatter-gather, DMA unmap, page unpin, refcount, or allocator operations. This gives high availability impact." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/irdma/verbs.c" ], "versions": [ { "version": "715fdb3b30541cc8180b7cdc6aa9f8c307afdf25", "lessThan": "62298a48f8b8788ad8b8464e6ffdf1ddebd2217e", "status": "affected", "versionType": "git" }, { "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "66964118f1f50ed85001c8fc9f7ab5bbdd021ee0", "status": "affected", "versionType": "git" }, { "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0f22c32141acdcda266b26cab2b830baf870f3e0", "status": "affected", "versionType": "git" }, { "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0c5d70bcb9d2275a1c8515a924016fcfeb4ab441", "status": "affected", "versionType": "git" }, { "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2", "status": "affected", "versionType": "git" }, { "version": "6.6.120", "lessThan": "6.6.136", "status": "affected", "versionType": "semver" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "drivers/infiniband/hw/irdma/verbs.c" ], "versions": [ { "version": "6.7", "status": "affected" }, { "version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.120", "versionEndExcluding": "6.6.136" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.83" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.24" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.14" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e" }, { "url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0" }, { "url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0" }, { "url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441" }, { "url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2" } ], "title": "RDMA/irdma: Fix double free related to rereg_user_mr", "x_generator": { "engine": "bippy-1.2.0" } } } }