---
id: CVE-2026-43128
title: 'RDMA/umem: Fix double dma_buf_unpin in failure path'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  RDMA/umem: Fix double dma_buf_unpin in failure path

  In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
  ib_umem_dmabuf_map_pages() can fail. If this occurs, th…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    70542b69abff34d24b11ae0bb200cc7a766d18df
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    b324327ff6f48d8065dca67eb3b91357e72726bd
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    ba3bf0f1bf1d5d0404678485e872980532fcc2c4
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    40126bcbefa79ea86672e05dae608596bab38319
  - >-
    Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 <
    104016eb671e19709721c1b0048dd912dc2e96be
  - Linux 5.16
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:14:57.128797Z'
published: '2026-05-06'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:20:33.859Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-43128'
references:
  - url: 'https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df'
  - url: 'https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd'
  - url: 'https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4'
  - url: 'https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf'
  - url: 'https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319'
  - url: 'https://git.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96be'
tags:
  - cve.org
epss: 0.00176
epssPercentile: 0.06648
ingestedAt: '2026-10-16T17:24:46.683Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dma_buf_unpin in failure path

In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf
is immediately unpinned but the umem_dmabuf->pinned flag is still
set. Then, when ib_umem_release() is called, it calls
ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let
the ib_umem_release/revoke path handle it. This also ensures the
proper unmap-unpin unwind ordering if the dmabuf_map_pages call
happened to fail due to dma_resv_wait_timeout (and therefore has
a non-NULL umem_dmabuf->sgt).

## Affected

- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < 70542b69abff34d24b11ae0bb200cc7a766d18df`
- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < b324327ff6f48d8065dca67eb3b91357e72726bd`
- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < ba3bf0f1bf1d5d0404678485e872980532fcc2c4`
- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf`
- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < 40126bcbefa79ea86672e05dae608596bab38319`
- `Linux >= 1e4df4a21c5ac722df1099eee30cad9246c889b5 < 104016eb671e19709721c1b0048dd912dc2e96be`
- `Linux 5.16`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.