Bug 2467144 (CVE-2026-43128) - CVE-2026-43128 kernel: RDMA/umem: Fix double dma_buf_unpin in failure path
Summary: CVE-2026-43128 kernel: RDMA/umem: Fix double dma_buf_unpin in failure path
Keywords:
Status: NEW
Alias: CVE-2026-43128
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-05-06 13:06 UTC by OSIDB Bzimport
Modified: 2026-07-01 08:59 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2026:19568 0 None None None 2026-05-20 12:57:44 UTC
Red Hat Product Errata RHSA-2026:19569 0 None None None 2026-05-20 12:15:52 UTC
Red Hat Product Errata RHSA-2026:27713 0 None None None 2026-06-22 05:01:29 UTC
Red Hat Product Errata RHSA-2026:33215 0 None None None 2026-06-29 19:23:53 UTC
Red Hat Product Errata RHSA-2026:33900 0 None None None 2026-07-01 00:13:35 UTC
Red Hat Product Errata RHSA-2026:34094 0 None None None 2026-07-01 08:59:03 UTC
Red Hat Product Errata RHSA-2026:34095 0 None None None 2026-07-01 08:40:55 UTC

Description OSIDB Bzimport 2026-05-06 13:06:45 UTC 
In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dma_buf_unpin in failure path

In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to
ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf
is immediately unpinned but the umem_dmabuf->pinned flag is still
set. Then, when ib_umem_release() is called, it calls
ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let
the ib_umem_release/revoke path handle it. This also ensures the
proper unmap-unpin unwind ordering if the dmabuf_map_pages call
happened to fail due to dma_resv_wait_timeout (and therefore has
a non-NULL umem_dmabuf->sgt).
Comment 1 Keith Grant 2026-05-06 17:53:26 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2026050620-CVE-2026-43128-5ff4@gregkh/T
Comment 7 errata-xmlrpc 2026-05-20 12:15:51 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10

Via RHSA-2026:19569 https://access.redhat.com/errata/RHSA-2026:19569
Comment 8 errata-xmlrpc 2026-05-20 12:57:44 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2026:19568 https://access.redhat.com/errata/RHSA-2026:19568
Comment 10 errata-xmlrpc 2026-06-22 05:01:28 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions

Via RHSA-2026:27713 https://access.redhat.com/errata/RHSA-2026:27713
Comment 11 errata-xmlrpc 2026-06-29 19:23:52 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 10.0 Extended Update Support

Via RHSA-2026:33215 https://access.redhat.com/errata/RHSA-2026:33215
Comment 12 errata-xmlrpc 2026-07-01 00:13:34 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:33900 https://access.redhat.com/errata/RHSA-2026:33900
Comment 13 errata-xmlrpc 2026-07-01 08:40:54 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions

Via RHSA-2026:34095 https://access.redhat.com/errata/RHSA-2026:34095
Comment 14 errata-xmlrpc 2026-07-01 08:59:02 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.6 Extended Update Support

Via RHSA-2026:34094 https://access.redhat.com/errata/RHSA-2026:34094
Note You need to log in before you can comment on or make changes to this bug.