{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2026-43502", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.014Z", "datePublished": "2026-05-21T12:17:50.444Z", "dateUpdated": "2026-08-05T12:28:25.250Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:25.250Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm->m_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerability is triggered by a local sendmsg(MSG_ZEROCOPY) syscall on an AF_RDS socket; the buggy cleanup decision depends only on local send-side failure conditions, not on any data received from a remote peer.\nAC:L - The attacker fully and deterministically controls the pre-queue failure (e.g., nonblocking socket with a full send buffer, or an invalid RDMA/atomic cmsg), so no race or uncontrolled condition is involved.\nPR:L - Creating an AF_RDS SOCK_SEQPACKET socket and enabling SO_ZEROCOPY require no capabilities (rds_create has no privilege check), so any unprivileged local user can reach the code.\nUI:N - The attacker triggers the entire flow through its own syscall; no action by another user is required.\nS:U - The memory corruption stays within the kernel's own security authority and does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - Releasing GUP-pinned user pages through the wrong path (and underflowing compound-page refcounts) can free/reuse pages still owned by user space, enabling disclosure of memory contents after reuse.\nI:H - The struct-page refcount underflow and improper page free constitute memory corruption that can be leveraged into a page use-after-free/write primitive, not merely a clean crash.\nA:H - The corrupted page accounting/refcounting and improper buddy-allocator free can cause VM_BUG_ON, oops, or kernel panic, in addition to leaking pinned-page accounting and the notifier struct." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rds/message.c" ], "versions": [ { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b", "status": "affected", "versionType": "git" }, { "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "44b550d88b267320459d518c0743a241ab2108fa", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "net/rds/message.c" ], "versions": [ { "version": "4.17", "status": "affected" }, { "version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }, { "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.258" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.209" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.175" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.140" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.88" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.30" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.0.7" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.1" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9" }, { "url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f" }, { "url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24" }, { "url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e" }, { "url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46" }, { "url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e" }, { "url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b" }, { "url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa" } ], "title": "net/rds: handle zerocopy send cleanup before the message is queued", "x_generator": { "engine": "bippy-1.2.0" } } } }