{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-43494",
  "modified": "2026-10-09T11:39:44Z",
  "upstream": [
    "CVE-2026-43494"
  ],
  "published": "2026-05-21T10:49:37Z",
  "summary": "net/rds: reset op_nents when zerocopy page pin fails",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm->data.op_mmp_znotifier is cleared.  But we fail to properly\nclear rm->data.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().",
  "severity": [
    {
      "type": "CVSS_V3",
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.175",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-43494"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-08-05T13:16:28Z",
    "severity": {
      "source": "kernel CNA",
      "cvss_v3_score": 7.8,
      "cvss_v3_severity": "High",
      "scenario": "AV:L - Triggered entirely by a local `sendmsg(MSG_ZEROCOPY)` syscall operating on the sending process's own user memory; a remote peer has no control over the page-pinning that fails, so it is not network-reachable.\nAC:L - The attacker fully controls the iovec layout and can deterministically pin one valid segment then point a later segment at unmapped memory to force `iov_iter_get_pages2()` to fail with `op_nents>=1`; no race or uncontrolled condition.\nPR:L - `rds_create()` performs no capability check, so any unprivileged local user can open the AF_RDS socket and reach the zerocopy send path; no real root or CAP needed.\nUI:N - The attacker performs the entire socket/setsockopt/sendmsg sequence themselves; no victim action is required.\nS:U - The corruption is within the kernel's own page-management security authority; there is no VM, IOMMU, or sandbox boundary crossed.\nC:H - The refcount underflow frees a page still mapped in the attacker's address space; once reused for other kernel/process data it remains readable through the stale mapping, enabling arbitrary memory disclosure.\nI:H - The same stale-mapping primitive permits writing into reallocated pages (page tables, slab, other tasks' memory), yielding an arbitrary-write/control-flow-hijack primitive suitable for privilege escalation.\nA:H - The double-free / page reference-count underflow corrupts kernel page state and reliably causes oops/panic, a full availability impact."
    }
  }
}