CVE-2026-43494
In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().
- Published May 21, 2026
- CVSS 7.8 high
- 0.2% chance of exploitation in the next 30 days (EPSS)
- Public exploit code is available
- A fix is available
Affected software
In the news
- Exploits and vulnerabilities in Q2 2026 Securelist ·
- Copy Fail and Its Descendants: A Real Human's Guide to Kernel Page-Cache LPEs VulnCheck Blog ·