PT-2026-42451 · Linux+3 · Linux Kernel+3

Aaron Esau + 1 · Published 2025-05-05 · Updated 2026-07-02 · CVE-2026-43494

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A double-free issue exists in the Reliable Delivery Service (RDS) implementation of the Linux kernel. When the iov iter get pages2() function fails within rds message zcopy from user(), the pinned pages are released and the rm->data.op mmp znotifier is cleared, but the rm->data.op nents variable is not properly reset. Consequently, when rds message purge() is subsequently called from rds sendmsg(), the cleanup loop iterates over the incorrect non-zero value of op nents, leading to a second attempt to free the same resources.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Double Free

Multiple Releases of Same Resource or Handle

Weakness Enumeration

CWE-415

CWE-1341

Related Identifiers

BDU:2026-07273

CVE-2026-43494

ECHO-ABBB-9356-9662

OPENSUSE-SU-2026:10954-1

SUSE-SU-2026:2195-1

SUSE-SU-2026:2238-1

USN-8370-1

USN-8371-1

USN-8373-1

USN-8374-1

USN-8388-1

USN-8388-2

USN-8389-1

USN-8391-1

USN-8392-1

USN-8393-1

USN-8426-1

USN-8426-2

USN-8440-1

USN-8461-1

USN-8462-1

USN-8489-1

USN-8497-1

USN-8499-1

Affected Products

Linuxmint

Linux Kernel

Red Os

Ubuntu

References · 1646

• 🔥 https://github.com/v12-security/pocs/tree/main/pintheft · Exploit
• 🔥 https://github.com/v12-security/pocs/blob/main/pintheft/poc.c · Exploit
• https://ubuntu.com/security/CVE-2026-23209 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-43277 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23107 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23064 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23262 · Vendor Advisory
• https://git.kernel.org/stable/c/c6e51512a784c4a7b86e1a044988696e3b3721fa · Patch
• https://ubuntu.com/security/CVE-2026-45917 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-68351 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23278 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-45984 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-23095 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2026-43494 · Vendor Advisory
• https://ubuntu.com/security/CVE-2026-46246 · Vendor Advisory