High 7.8Published May 21, 2026

CVE-2026-43494net/rds: reset op_nents when zerocopy page pin fails

Updated under an hour ago (Oct 28, 2026, 5:30 AM ET)

Does this affect you?

It affects Linux and 2 other products. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

CVSS: 7.8 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-1341, CWE-415
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 19, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before c6e51512a784c4a7b86e1a044988696e3b3721fa; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before 03014551938a0887fa55f18ce49b70158a9c0113; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before d84ce1786ce40fdd3dd98db47aec5527817e1ef6; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before 9115669faedccdda100428e2d26fd0aac8c50799; 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 builds before 0bbbff00a15b1df2cac9014d6cf4b6890f473353; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before 640e37f58f991546a87540d067279c2c1fa9fe51; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before 290e833d1acb1093bc121fcdc97f5e6161157479; from 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 before e174929793195e0cd6a4adb0cad731b39f9019b4	CNA record
Red Hat Red Hat Enterprise Linux 10 redhat:enterprise_linux	10	CISA ADP
linux linux_kernel linux:linux_kernel	from 4.17 before 5.10.258; from 5.11 before 5.15.209; from 5.16 before 6.1.175; from 6.2 before 6.6.141; from 6.7 before 6.12.91; from 6.13 before 6.18.33; from 6.19 before 7.0.10; 7.1; and 2 more ranges	NVD

References

References

https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa	patch
https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113	patch
https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6	patch
https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799	patch
https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353	patch
https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51	patch
https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479	patch
https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4	patch
https://github.com/v12-security/pocs/tree/main/pintheft	exploit, third-party-advisory
http://www.openwall.com/lists/oss-security/2026/05/21/2	mailing-list
1–10 of 13

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.