Vulnerability · Published May 21, 2026 · Assigned by Linux

CVE-2026-43494net/rds: reset op_nents when zerocopy page pin fails

High 7.8

In plain English

A high-severity double free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 36% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.4%top 64.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.176-1DEBIAN-CVE-2026-43494
Debian:13linux6.12.90-2DEBIAN-CVE-2026-43494
Debian:14linux7.0.10-1DEBIAN-CVE-2026-43494
Ubuntu:22.04:LTSlinux5.15.0-181.191UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux5.15.0-181.191USN-8388-1
Ubuntu:24.04:LTSlinux6.8.0-124.124UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux6.8.0-124.124USN-8373-1
Ubuntu:25.10linux6.17.0-35.35UBUNTU-CVE-2026-43494
Ubuntu:25.10linux6.17.0-35.35USN-8371-1
Ubuntu:26.04:LTSlinux7.0.0-22.22USN-8370-1
Ubuntu:26.04:LTSlinux7.0.0-22.22UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws5.15.0-1109.116UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws5.15.0-1109.116USN-8388-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1057.60USN-8373-1
Ubuntu:24.04:LTSlinux-aws6.8.0-1057.60UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-aws6.17.0-1017.17USN-8371-1
Ubuntu:25.10linux-aws6.17.0-1017.17UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-aws7.0.0-1006.6USN-8370-1
Ubuntu:26.04:LTSlinux-aws7.0.0-1006.6UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1017.17~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-aws-6.176.17.0-1017.17~24.04.1USN-8374-1
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1057.60~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1057.60~22.04.1USN-8373-1
Ubuntu:22.04:LTSlinux-azure5.15.0-1114.123USN-8426-2
Ubuntu:22.04:LTSlinux-azure5.15.0-1114.123UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure6.8.0-1058.64UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure6.8.0-1058.64USN-8373-1
Ubuntu:25.10linux-azure6.17.0-1017.17USN-8371-1
Ubuntu:25.10linux-azure6.17.0-1017.17UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-azure7.0.0-1007.7UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-azure7.0.0-1007.7USN-8461-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1017.17~24.04.1USN-8371-1
Ubuntu:24.04:LTSlinux-azure-6.176.17.0-1017.17~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1059.65~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1114.123UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-fde6.8.0-1058.65UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-azure-fdeno fix listedUBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-azure-fde7.0.0-1006.6UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-azure-fde-6.86.8.0-1058.65~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp5.15.0-1109.118UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp5.15.0-1109.118USN-8388-1
Ubuntu:24.04:LTSlinux-gcp6.8.0-1060.63UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-gcp6.8.0-1060.63USN-8373-1
Ubuntu:25.10linux-gcp6.17.0-1018.19UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-gcp6.17.0-1018.19USN-8374-1
Ubuntu:26.04:LTSlinux-gcp7.0.0-1005.5USN-8370-1
Ubuntu:26.04:LTSlinux-gcp7.0.0-1005.5UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1018.19~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-gcp-6.176.17.0-1018.19~24.04.1USN-8374-1
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1060.63~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1060.63~22.04.1USN-8373-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1105.111UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gke5.15.0-1105.111USN-8388-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1055.61USN-8373-1
Ubuntu:24.04:LTSlinux-gke6.8.0-1055.61UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1092.100UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1092.100USN-8388-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1042.45USN-8373-1
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1042.45UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-35.35~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-hwe-6.176.17.0-35.35~24.04.1USN-8371-1
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-124.124~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-124.124~22.04.1USN-8373-1
Ubuntu:24.04:LTSlinux-hwe-7.07.0.0-28.28~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-ibm5.15.0-1103.106UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-ibm5.15.0-1103.106USN-8388-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1057.58UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-ibm6.8.0-1057.58USN-8373-1
Ubuntu:26.04:LTSlinux-ibm7.0.0-1007.7USN-8370-1
Ubuntu:26.04:LTSlinux-ibm7.0.0-1007.7UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1057.58~22.04.1USN-8373-1
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1057.58~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1104.110UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1104.110USN-8388-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1101.106USN-8388-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1101.106UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-181.191UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-134.134.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-134.134.1~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1104.105USN-8388-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1104.105UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1055.58UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1055.58USN-8373-1
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1009.9UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-nvidia7.0.0-1009.9USN-8370-1
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1021.21USN-8371-1
Ubuntu:24.04:LTSlinux-nvidia-6.176.17.0-1021.21UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1055.58~22.04.1USN-8373-1
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1055.58~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1055.58.1USN-8373-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1055.58.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1061.61UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1061.61USN-8388-1
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1026.26USN-8373-1
Ubuntu:24.04:LTSlinux-nvidia-tegra6.8.0-1026.26UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1050.50USN-8388-1
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1050.50UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1024.24UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oem-6.176.17.0-1024.24USN-8371-1
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1008.8USN-8489-1
Ubuntu:26.04:LTSlinux-oem-7.07.0.0-1008.8UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oracle5.15.0-1106.112UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oracle5.15.0-1106.112USN-8388-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1054.55USN-8373-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1054.55UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-oracle6.17.0-1016.16UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-oracle6.17.0-1016.16USN-8371-1
Ubuntu:26.04:LTSlinux-oracle7.0.0-1005.5UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-oracle7.0.0-1005.5USN-8370-1
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1016.16~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-oracle-6.176.17.0-1016.16~24.04.1USN-8371-1
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1054.55~22.04.1USN-8373-1
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1054.55~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-raspi5.15.0-1103.106USN-8388-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1103.106UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-raspi6.8.0-1057.61UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-raspi6.8.0-1057.61USN-8373-1
Ubuntu:25.10linux-raspi6.17.0-1018.18USN-8371-1
Ubuntu:25.10linux-raspi6.17.0-1018.18UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-raspi7.0.0-1011.11USN-8370-1
Ubuntu:26.04:LTSlinux-raspi7.0.0-1011.11UBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-43494
Ubuntu:25.10linux-realtime6.17.0-1014.16UBUNTU-CVE-2026-43494
Ubuntu:25.10linux-realtime6.17.0-1014.16USN-8371-1
Ubuntu:26.04:LTSlinux-realtime7.0.0-22.22.1USN-8370-1
Ubuntu:26.04:LTSlinux-realtime7.0.0-22.22.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-43494
Ubuntu:25.10linux-riscv6.17.0-35.35.1UBUNTU-CVE-2026-43494
Ubuntu:26.04:LTSlinux-riscv7.0.0-22.22.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-riscv-6.176.17.0-35.35.1~24.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-124.124~22.04.1UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-43494
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1032.33UBUNTU-CVE-2026-43494
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1074.78UBUNTU-CVE-2026-43494

Affected products (as reported)

VendorProductVersions
Linux Linux 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before c6e51512a784c4a7b86e1a044988696e3b3721fa0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before 03014551938a0887fa55f18ce49b70158a9c01130cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before d84ce1786ce40fdd3dd98db47aec5527817e1ef60cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before 9115669faedccdda100428e2d26fd0aac8c507990cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before 0bbbff00a15b1df2cac9014d6cf4b6890f4733530cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before 640e37f58f991546a87540d067279c2c1fa9fe510cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before 290e833d1acb1093bc121fcdc97f5e61611574790cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 – before e174929793195e0cd6a4adb0cad731b39f9019b4
Linux Linux 4.17

Weakness: CWE-1341, CWE-415 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References