PT-2026-37430 · Linux · Linux

Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-43120

Mitre

In the Linux kernel, the following vulnerability has been resolved:

RDMA/irdma: Fix double free related to rereg user mr

If IB MR REREG TRANS is set during rereg user mr, the umem will be released and a new one will be allocated in irdma rereg mr trans. If any step of irdma rereg mr trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv dereg mr (as they should). Then, the dereg mr path will see a non-NULL umem and attempt to call ib umem release again.

Fix this by setting iwmr->region to NULL after ib umem release.

Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")

Related Identifiers

CVE-2026-43120

Affected Products

Linux

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-43120 · Security Note
• https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0 · Note
• https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e · Note
• https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0 · Note
• https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441 · Note
• https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 · Note