{"id":"CVE-2026-43120","title":"RDMA/irdma: Fix double free related to rereg_user_mr","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin ird…","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 < 62298a48f8b8788ad8b8464e6ffdf1ddebd2217e","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 66964118f1f50ed85001c8fc9f7ab5bbdd021ee0","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 0f22c32141acdcda266b26cab2b830baf870f3e0","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 0c5d70bcb9d2275a1c8515a924016fcfeb4ab441","Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2","Linux >= 6.6.120 < 6.6.136","Linux 6.7"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:14:52.649635Z"},"published":"2026-05-06","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:33.540Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43120","references":[{"url":"https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"},{"url":"https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"},{"url":"https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"},{"url":"https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"},{"url":"https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"}],"tags":["cve.org"],"epss":0.00175,"epssPercentile":0.06553,"ingestedAt":"2026-10-16T17:24:46.683Z","slug":"CVE-2026-43120","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")\n\n## Affected\n\n- `Linux >= 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 < 62298a48f8b8788ad8b8464e6ffdf1ddebd2217e`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 66964118f1f50ed85001c8fc9f7ab5bbdd021ee0`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 0f22c32141acdcda266b26cab2b830baf870f3e0`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 0c5d70bcb9d2275a1c8515a924016fcfeb4ab441`\n- `Linux >= 5ac388db27c443dadfbb0b8b23fa7ccf429d901a < 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2`\n- `Linux >= 6.6.120 < 6.6.136`\n- `Linux 6.7`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":43,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}