Description
In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dma_buf_unpin in failure path

In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf
is immediately unpinned but the umem_dmabuf->pinned flag is still
set. Then, when ib_umem_release() is called, it calls
ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let
the ib_umem_release/revoke path handle it. This also ensures the
proper unmap-unpin unwind ordering if the dmabuf_map_pages call
happened to fail due to dma_resv_wait_timeout (and therefore has
a non-NULL umem_dmabuf->sgt).
Published: 2026-05-06
Score: n/a
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The bug causes the RDMA umem subsystem to unpin a DMA buffer twice when a mapping failure occurs. The first unpin is performed immediately on failure, but the internal flag is left set. When the buffer is released later, the system attempts to unpin it again, resulting in a double‑unpin operation. Because the description does not indicate any crash or data corruption, the impact remains uncertain; the double unpin may lead to resource mis‑management or kernel instability under certain conditions.

Affected Systems

All Linux kernels that include the RDMA umem code path prior to the series of commits that address the double‑unpin condition are potentially affected. Versions older than the patched revisions (identified by the provided commit hashes) are at risk. No explicit version range is listed, so any system running a pre‑patched kernel should consider this issue.

Risk and Exploitability

The CVSS and EPSS information is not available, so overall risk assessment is limited. The bug manifests when a RDMA buffer mapping fails, requiring an attacker to trigger that failure path; this suggests a local context. Since no public exploitation is known, the likelihood of exploitation is uncertain. The fact that the vulnerability is not listed in the CISA KEV catalog indicates no known, active exploitation.

Generated by OpenCVE AI on May 6, 2026 at 16:42 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the Linux kernel update that includes the relevant commits to eliminate the double unpin situation.
  • If an immediate kernel upgrade is not possible, disable RDMA-related modules (such as ib_umem and ib_core) or services that use RDMA to prevent the mapping path from being exercised.
  • After applying the patch or disabling RDMA, monitor kernel logs for anomalies related to dma_buf_unpin or related errors.

Generated by OpenCVE AI on May 6, 2026 at 16:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Wed, 06 May 2026 17:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-415

Wed, 06 May 2026 12:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).
Title RDMA/umem: Fix double dma_buf_unpin in failure path
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-05-06T11:27:17.474Z

Reserved: 2026-05-01T14:12:55.988Z

Link: CVE-2026-43128

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-05-06T12:16:29.837

Modified: 2026-05-06T13:07:51.607

Link: CVE-2026-43128

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-05-06T16:45:07Z

Weaknesses