{"id":"CVE-2026-43494","title":"net/rds: reset op_nents when zerocopy page pin fails","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), …","severity":"high","cvss":7.8,"cvssVector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvssSource":"cna","vendor":"Linux","product":"Linux","affected":["Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < c6e51512a784c4a7b86e1a044988696e3b3721fa","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 03014551938a0887fa55f18ce49b70158a9c0113","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < d84ce1786ce40fdd3dd98db47aec5527817e1ef6","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 9115669faedccdda100428e2d26fd0aac8c50799","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 0bbbff00a15b1df2cac9014d6cf4b6890f473353","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 640e37f58f991546a87540d067279c2c1fa9fe51","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 290e833d1acb1093bc121fcdc97f5e6161157479","Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < e174929793195e0cd6a4adb0cad731b39f9019b4","Linux 4.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"total","timestamp":"2026-10-16T15:17:47.906032Z"},"exploitAvailable":true,"published":"2026-05-21","updated":"2026-10-16","sourceUpdated":"2026-10-16T15:20:43.142Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43494","references":[{"url":"https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa"},{"url":"https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113"},{"url":"https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6"},{"url":"https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799"},{"url":"https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353"},{"url":"https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51"},{"url":"https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479"},{"url":"https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4"},{"url":"https://github.com/v12-security/pocs/tree/main/pintheft"}],"tags":["cve.org","exploit-available"],"epss":0.00194,"epssPercentile":0.08536,"exploits":{"github":7,"githubRepos":["https://github.com/0xBlackash/CVE-2026-43494","https://github.com/jayhutajulu1/CVE-2026-43494-PinTheft-PoC","https://github.com/Koshmare-Blossom/PinTheft-asm"],"checkedAt":"2026-10-16T17:25:21.011Z"},"ingestedAt":"2026-10-16T17:24:46.697Z","slug":"CVE-2026-43494","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm->data.op_mmp_znotifier is cleared.  But we fail to properly\nclear rm->data.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().\n\n## Affected\n\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < c6e51512a784c4a7b86e1a044988696e3b3721fa`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 03014551938a0887fa55f18ce49b70158a9c0113`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < d84ce1786ce40fdd3dd98db47aec5527817e1ef6`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 9115669faedccdda100428e2d26fd0aac8c50799`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 0bbbff00a15b1df2cac9014d6cf4b6890f473353`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 640e37f58f991546a87540d067279c2c1fa9fe51`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < 290e833d1acb1093bc121fcdc97f5e6161157479`\n- `Linux >= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 < e174929793195e0cd6a4adb0cad731b39f9019b4`\n- `Linux 4.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"midnight","depthScore":55,"depthScoreParts":{"impact":42.9,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}