CVE-2026-43128
RDMA/umem: Fix double dma_buf_unpin in failure path
Using Linux by Linux?
Get instant alerts when new vulnerabilities affect Linux - before attackers find them.
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).
Affected
Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.
Remediation
No guide yetNo remediation guidance has been written for this CVE yet. What the record does show:
Patch and advisory references
- https://git.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18df
- https://git.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bd
- https://git.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4
- https://git.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
- https://git.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319
References (6)
SSVC — Action Prioritization
SSVC signals action urgency (what to patch first), separate from CVSS which measures severity.
CVSS
Quick Info
Get alerted
Stop reading CVE feeds looking for your own stack
Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.