CVE-2026-43120
Awaiting Analysis Awaiting Analysis - Queue
Double Free in Linux Kernel RDMA/irdma Driver

Publication date: 2026-05-06

Last updated on: 2026-05-06

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again. Fix this by setting iwmr->region to NULL after ib_umem_release. Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2026-05-06
Last Modified
2026-05-06
Generated
2026-05-07
AI Q&A
2026-05-06
EPSS Evaluated
N/A
NVD
CVE-2026-43120
EUVD
EUVD-2026-27650
Affected Vendors & Products
Showing 3 associated CPEs
Vendor Product Version / Range
linux_kernel linux_kernel *
linux_kernel linux_kernel to 5ac388db27c4 (inc)
linux linux_kernel *
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability exists in the Linux kernel's RDMA/irdma component related to memory region re-registration (rereg_user_mr). When a specific flag (IB_MR_REREG_TRANS) is set during the re-registration process, the system releases a memory region (umem) and allocates a new one. If an error occurs after the new memory is allocated, the system releases the new memory but fails to clear the reference to it (iwmr->region is not set to NULL). This causes a double free error because the user, upon receiving the failure, will call a deregistration function (ibv_dereg_mr) which attempts to release the memory again, leading to potential memory corruption or crashes.


How can this vulnerability impact me? :

This vulnerability can lead to a double free condition in the Linux kernel's RDMA subsystem. Such a double free can cause memory corruption, system instability, crashes, or potentially allow an attacker to execute arbitrary code or cause a denial of service by exploiting the improper memory management.


What immediate steps should I take to mitigate this vulnerability?

The vulnerability is fixed in the Linux kernel by correcting the double free issue in the RDMA/irdma subsystem. To mitigate this vulnerability, you should update your Linux kernel to a version that includes the fix identified by commit 5ac388db27c4.

No other immediate mitigation steps or workarounds are provided.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart