{"id":"CVE-2026-43494","published":"2026-05-21T10:49:21Z","modified":"2026-10-19T19:26:37Z","title":"net/rds: reset op_nents when zerocopy page pin fails","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < c6e51512a784c4a7b86e1a044988696e3b3721fa",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 03014551938a0887fa55f18ce49b70158a9c0113",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < d84ce1786ce40fdd3dd98db47aec5527817e1ef6",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 9115669faedccdda100428e2d26fd0aac8c50799",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 0bbbff00a15b1df2cac9014d6cf4b6890f473353",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 640e37f58f991546a87540d067279c2c1fa9fe51",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < 290e833d1acb1093bc121fcdc97f5e6161157479",">= 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3, < e174929793195e0cd6a4adb0cad731b39f9019b4"]},{"vendor":"Linux","product":"Linux","versions":["4.17"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: reset op_nents when zerocopy page pin fails\n\nWhen iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),\nthe pinned pages are released with put_page(), and\nrm->data.op_mmp_znotifier is cleared.  But we fail to properly\nclear rm->data.op_nents.\n\nLater when rds_message_purge() is called from rds_sendmsg() the\ncleanup loop iterates over the incorrectly non zero number of\nop_nents and frees them again.\n\nFix this by properly resetting op_nents when it should be in\nrds_message_zcopy_from_user().","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.00411,"percentile":0.3538,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-08-26","exploitedFirstSeen":"2026-08-26","ransomware":false,"evidence":[{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","date":"2026-08-26"}],"evidenceTotal":1,"provenance":"source"},"exploited":true,"otx":{"pulseCount":9,"pulses":[{"name":"Known_Cve | May 30, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a199f66a765b0a5dce00131","created":"2026-05-29"},{"name":"Known_Cve | May 29, 2026","url":"https://otx.alienvault.com/pulse/6a184eb0b82a588940895fc7","created":"2026-05-28"},{"name":"Known_Cve | May 28, 2026","url":"https://otx.alienvault.com/pulse/6a16fc6bdf8b1c1279eacd4b","created":"2026-05-27"},{"name":"Known_Cve | May 27, 2026","url":"https://otx.alienvault.com/pulse/6a15ab38c2d540766cba1933","created":"2026-05-26"},{"name":"Known_Cve | May 26, 2026","url":"https://otx.alienvault.com/pulse/6a1459663d825a820c563cd8","created":"2026-05-25"},{"name":"Known_Cve | May 25, 2026","url":"https://otx.alienvault.com/pulse/6a1307e0c40ccc9505d356cb","created":"2026-05-24"},{"name":"Known_Cve | May 24, 2026","url":"https://otx.alienvault.com/pulse/6a11b68cf1eac448d6e6392f","created":"2026-05-23"},{"name":"Known_Cve | May 23, 2026","url":"https://otx.alienvault.com/pulse/6a10657811ce8e8449e3af12","created":"2026-05-22"},{"name":"Known_Cve | May 22, 2026","url":"https://otx.alienvault.com/pulse/6a0f13fd08d4602f56683eec","created":"2026-05-21"}],"provenance":"machine"},"cwes":[{"id":"CWE-1341","name":"Multiple Releases of Same Resource or Handle"},{"id":"CWE-415","name":"Double Free"}],"references":[{"url":"https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa","tags":[]},{"url":"https://git.kernel.org/stable/c/03014551938a0887fa55f18ce49b70158a9c0113","tags":[]},{"url":"https://git.kernel.org/stable/c/d84ce1786ce40fdd3dd98db47aec5527817e1ef6","tags":[]},{"url":"https://git.kernel.org/stable/c/9115669faedccdda100428e2d26fd0aac8c50799","tags":[]},{"url":"https://git.kernel.org/stable/c/0bbbff00a15b1df2cac9014d6cf4b6890f473353","tags":[]},{"url":"https://git.kernel.org/stable/c/640e37f58f991546a87540d067279c2c1fa9fe51","tags":[]},{"url":"https://git.kernel.org/stable/c/290e833d1acb1093bc121fcdc97f5e6161157479","tags":[]},{"url":"https://git.kernel.org/stable/c/e174929793195e0cd6a4adb0cad731b39f9019b4","tags":[]},{"url":"https://github.com/v12-security/pocs/tree/main/pintheft","tags":[]},{"url":"http://www.openwall.com/lists/oss-security/2026/05/21/2","tags":[]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43494","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2480434","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43494.json","tags":["x_sadp-csaf-vex"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-31267","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-31267","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":7,"skipped":0,"earliest":"2026-05-20","earliestUrl":"https://github.com/suominen/pintheft","repos":[{"name":"0xBlackash/CVE-2026-43494","url":"https://github.com/0xBlackash/CVE-2026-43494","stars":2,"created":"2026-05-22"},{"name":"jayhutajulu1/CVE-2026-43494-PinTheft-PoC","url":"https://github.com/jayhutajulu1/CVE-2026-43494-PinTheft-PoC","stars":1,"created":"2026-05-25"},{"name":"Koshmare-Blossom/PinTheft-asm","url":"https://github.com/Koshmare-Blossom/PinTheft-asm","stars":1,"created":"2026-05-28"},{"name":"letsr00t/CVE-2026-43494-PinTheft-PoC","url":"https://github.com/letsr00t/CVE-2026-43494-PinTheft-PoC","stars":1,"created":"2026-05-30"},{"name":"suominen/pintheft","url":"https://github.com/suominen/pintheft","stars":0,"created":"2026-05-20"}]},"first":{"date":"2026-05-20","source":"PoC-in-GitHub","url":"https://github.com/suominen/pintheft"},"provenance":"source"},"exploitRefs":["https://github.com/v12-security/pocs/tree/main/pintheft"],"flow":[],"timeline":[{"date":"2026-05-20","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/suominen/pintheft","provenance":"source"},{"date":"2026-05-21","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-43494","provenance":"source"},{"date":"2026-08-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":64.8,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 66 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":7.08,"detail":"percentile 0.3538"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD exploit link; 7 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.27,"detail":"9 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}