VOOZH about

URL: https://nvd.nist.gov/vuln/detail/CVE-2026-43494

⇱ NVD - CVE-2026-43494


  1. Vulnerabilities

CVE-2026-43494 Detail

Modified After Enrichment

This CVE record has been updated after NVD enrichment efforts were completed. Enrichment data supplied by the NVD may require amendment due to these changes.

Description

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().


Metrics

 
NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.
CVSS 4.0 Severity and Vector Strings:

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
http://www.openwall.com/lists/oss-security/2026/05/21/2 CVE Mailing List 
https://access.redhat.com/security/cve/CVE-2026-43494 redhat-SADP
https://bugzilla.redhat.com/show_bug.cgi?id=2480434 redhat-SADP
https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113 kernel.org Patch 
https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353 kernel.org Patch 
https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479 kernel.org Patch 
https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51 kernel.org Patch 
https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799 kernel.org Patch 
https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa kernel.org Patch 
https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6 kernel.org Patch 
https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4 kernel.org Patch 
https://github.com/v12-security/pocs/tree/main/pintheft kernel.org Exploit  Third Party Advisory 
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json redhat-SADP

Weakness Enumeration

CWE-ID CWE Name Source
NVD-CWE-noinfo Insufficient Information πŸ‘ cwe source acceptance level
NIST  
CWE-1341 Multiple Releases of Same Resource or Handle redhat-SADP  

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

9 change records found show changes

CVE Modified by redhat-SADP 6/29/2026 11:19:46 PM

Action Type Old Value New Value
Added CVSS V3.1
AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H


Added CWE
CWE-1341


Added Reference
https://access.redhat.com/security/cve/CVE-2026-43494


Added Reference
https://bugzilla.redhat.com/show_bug.cgi?id=2480434


Added Reference
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json


Added Affected
[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"]}]


Initial Analysis by NIST 6/26/2026 1:30:30 PM

Action Type Old Value New Value
Added CWE
NVD-CWE-noinfo


Added CPE Configuration
OR
 *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.175
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.209
 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.17 up to (excluding) 5.10.258


Added Reference Type
CVE: http://www.openwall.com/lists/oss-security/2026/05/21/2 Types: Mailing List


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6 Types: Patch


Added Reference Type
kernel.org: https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4 Types: Patch


Added Reference Type
kernel.org: https://github.com/v12-security/pocs/tree/main/pintheft Types: Exploit, Third Party Advisory


CVE Modified by kernel.org 6/17/2026 6:49:48 AM

Action Type Old Value New Value
Added Affected Record truncated, showing 2048 of 2447 characters.
View Entire Change Record
[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rds/message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"c6e51512a784c4a7b86e1a044988696e3b3721fa","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"03014551938a0887fa55f18ce49b70158a9c0113","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"d84ce1786ce40fdd3dd98db47aec5527817e1ef6","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"9115669faedccdda100428e2d26fd0aac8c50799","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"0bbbff00a15b1df2cac9014d6cf4b6890f473353","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"640e37f58f991546a87540d067279c2c1fa9fe51","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"290e833d1acb1093bc121fcdc97f5e6161157479","versionType":"git","status":"affected"},{"version":"0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3","lessThan":"e174929793195e0cd6a4adb0cad731b39f9019b4","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rds/message.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"4.17","status":"affected"},{"version":"0","lessThan":"4.17","versionType":"semver","status":"unaffected"},{"version":"5.10.258","lessThanOrEqual":"5.10.*","versionType":"semver","status":"unaffected"},{"version":"5.15.209","lessThanOrEqual":"5.15.*","versionType":"semver","status":"unaffected"},{"version":"6.1.175","lessThanOrEqual":"6.1.*","versionType":"semver","status":"unaffected"},{"version":"6.6.141","lessThanOrEqual":"6.6.*","versionType":"semver","status"

CVE Modified by kernel.org 6/12/2026 6:16:22 AM

Action Type Old Value New Value
Added Reference
https://github.com/v12-security/pocs/tree/main/pintheft


CVE Modified by kernel.org 6/01/2026 1:17:05 PM

Action Type Old Value New Value
Added Reference
https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113


Added Reference
https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa


Added Reference
https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6


CVE Modified by kernel.org 5/30/2026 7:17:05 AM

Action Type Old Value New Value
Added CVSS V3.1
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H


CVE Modified by kernel.org 5/23/2026 8:17:02 AM

Action Type Old Value New Value
Added Reference
https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353


Added Reference
https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479


Added Reference
https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51


Added Reference
https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799


CVE Modified by CVE 5/21/2026 12:16:23 PM

Action Type Old Value New Value
Added Reference
http://www.openwall.com/lists/oss-security/2026/05/21/2


New CVE Received from kernel.org 5/21/2026 8:16:19 AM

Action Type Old Value New Value
Added Description
In the Linux kernel, the following vulnerability has been resolved:

net/rds: reset op_nents when zerocopy page pin fails

When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),
the pinned pages are released with put_page(), and
rm->data.op_mmp_znotifier is cleared. But we fail to properly
clear rm->data.op_nents.

Later when rds_message_purge() is called from rds_sendmsg() the
cleanup loop iterates over the incorrectly non zero number of
op_nents and frees them again.

Fix this by properly resetting op_nents when it should be in
rds_message_zcopy_from_user().


Added Reference
https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4


Quick Info

CVE Dictionary Entry:
CVE-2026-43494
NVD Published Date:
05/21/2026
NVD Last Modified:
06/29/2026
Source:
kernel.org