CVE-2026-43502 - Vulnerability Details

- net/rds: handle zerocopy send cleanup before the message is queued

Description

In the Linux kernel, the following vulnerability has been resolved:

net/rds: handle zerocopy send cleanup before the message is queued

A zerocopy send can fail after user pages have been pinned but before
the message is attached to the sending socket.

The purge path currently infers zerocopy state from rm->m_rs, so an
unqueued message can be cleaned up as if it owned normal payload pages.
However, zerocopy ownership is really determined by the presence of
op_mmp_znotifier, regardless of whether the message has reached the
socket queue.

Capture op_mmp_znotifier up front in rds_message_purge() and use it as
the cleanup discriminator. If the message is already associated with a
socket, keep the existing completion path. Otherwise, drop the pinned
page accounting directly and release the notifier before putting the
payload pages.

This keeps early send failure cleanup consistent with the zerocopy
lifetime rules without changing the normal queued completion path.

Published: 2026-05-21

Score: 7.8 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The Linux kernel’s RDS networking stack contains a logic error in the cleanup path for zero‑copy sends that can fail after user pages have been pinned but before the message is queued. The current implementation assumes a zerocopy state based on an indicator that is only valid for queued messages, so unqueued messages may be cleaned up as if they owned regular payload pages. This misinterpretation leads to incorrect handling of pinned pages, potentially resulting in memory corruption or kernel instability. The flaw is catalogued as CWE‑459, indicating an improper use of state that can corrupt kernel data structures.

Affected Systems

Any Linux kernel installation that includes the RDS protocol and does not contain the series of commits that introduce the patch is affected. The advisory does not specify a version range, so all kernels that have the RDS subsystem prior to the referenced fixes should be considered vulnerable.

Risk and Exploitability

The CVSS score of 7.8 reflects high severity, while the EPSS score of < 1 % indicates a very low probability of exploitation. The vulnerability is not listed in CISA’s KEV catalog. Exploitation would likely require a local or privileged attacker who can send RDS packets that trigger a zero‑copy send failure, leading to improper cleanup and potential kernel instability.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< e9aefdc5c53fe9aed108c14e3d155710a1bb14c9
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 46662f7dc59475995609bf3e9d27eb36f4acf26f
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 1e262db7675e27f42c3f3f47d6011855f4454f24
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 3abc8983b2bae3f487f77d9da5527d7d6b210d46
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 14ef6fd18db2494098b21e0471bf27a1d8e9993e
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b
`0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3`	affected	< 44b550d88b267320459d518c0743a241ab2108fa

Linux

affected

Version	Status	Constraints
`4.17`	affected	—
`0`	unaffected	< 4.17
`5.10.258`	unaffected	≤ 5.10.*
`5.15.209`	unaffected	≤ 5.15.*
`6.1.175`	unaffected	≤ 6.1.*
`6.6.140`	unaffected	≤ 6.6.*
`6.12.88`	unaffected	≤ 6.12.*
`6.18.30`	unaffected	≤ 6.18.*
`7.0.7`	unaffected	≤ 7.0.*
`7.1-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,21d70744e6d3bbf9293aa1ee6fba7c53ad75275e)`	affected	code_commit	—
`[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,3abc8983b2bae3f487f77d9da5527d7d6b210d46)`	affected	code_commit	—
`[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,14ef6fd18db2494098b21e0471bf27a1d8e9993e)`	affected	code_commit	—
`[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b)`	affected	code_commit	—
`[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,44b550d88b267320459d518c0743a241ab2108fa)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.17`	affected	generic	—
`[0,4.17)`	unaffected	generic	—
`[6.6.140,6.7.0)`	unaffected	semver	—
`[6.12.88,6.13.0)`	unaffected	semver	—
`[6.18.30,6.19.0)`	unaffected	semver	—
`[7.0.7,7.1.0)`	unaffected	semver	—
`[7.1-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the RDS zerocopy send cleanup fix.
If a kernel upgrade is not immediately possible, disable the RDS protocol (for example, set sysctl net.rds.enabled=0, unload the rds module, or block RDS traffic with firewall rules).
Continuously monitor kernel logs (e.g., dmesg, /var/log/kern.log) for RDS‑related warnings or errors and apply patches or mitigations as soon as they become available.

Generated by OpenCVE AI on May 30, 2026 at 13:34 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00013.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b
https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e
https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24
https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e
https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46
https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa
https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f
https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9
https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43502-01ec@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-43502
https://www.cve.org/CVERecord?id=CVE-2026-43502

History

Mon, 01 Jun 2026 17:00:00 +0000

Type	Values Removed	Values Added
References		https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24 https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9

Sat, 30 May 2026 11:00:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 7.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}`

Fri, 22 May 2026 02:15:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416 CWE-590

Fri, 22 May 2026 00:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-459
References		https://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43502-01ec@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-43502 https://www.cve.org/CVERecord?id=CVE-2026-43502
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Thu, 21 May 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416 CWE-590

Thu, 21 May 2026 12:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path.
Title		net/rds: handle zerocopy send cleanup before the message is queued
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46 https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-05-21T12:17:50.444Z

Updated: 2026-06-01T16:16:11.767Z

Reserved: 2026-05-01T14:12:56.014Z

Link: CVE-2026-43502

Vulnrichment

No data.

NVD

Status : Awaiting Analysis

Published: 2026-05-21T13:16:19.520

Modified: 2026-06-01T17:17:07.490

Link: CVE-2026-43502

Redhat

Severity : Moderate

Publid Date: 2026-05-21T00:00:00Z

Links: CVE-2026-43502 - Bugzilla

OpenCVE Enrichment

Updated: 2026-05-30T13:45:24Z

Weaknesses

CWE-459
Incomplete Cleanup

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object