CVE-2026-43120 Details
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again. Fix this by setting iwmr->region to NULL after ib_umem_release. Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
A double free vulnerability has been identified in the Linux kernel's RDMA/Irdma component, specifically related to the re-registration of user memory regions. This issue arises when the IB_MR_REREG_TRANS flag is set during the re-registration process. In such cases, the user memory (umem) is released and a new one is allocated. If any step of the re-registration process fails after the new umem is allocated, the umem is released but the corresponding region pointer is not cleared. This oversight allows the failure to be propagated to the user, who then correctly calls the deregistration function. However, the deregistration process encounters a non-NULL umem and attempts to release it again, leading to a double free condition.
The vulnerability has been fixed in the Linux kernel. Users should upgrade to the latest version that includes the fix.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441 | kernel.org | Patch |
| https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0 | kernel.org | Patch |
| https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 | kernel.org | Patch |
| https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e | kernel.org | Patch |
| https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-415 | Double Free | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.6.120, < 6.6.136 >= 6.7, < 6.12.83 >= 6.13, < 6.18.24 >= 6.19, < 6.19.14 7.0 rc1 7.0 rc2 7.0 rc3 7.0 rc4 7.0 rc5 |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | kernel.org |
| May 12, 2026 | Initial Analysis | [email protected] |
| May 8, 2026 | CVE Modified | kernel.org |
| May 6, 2026 | New CVE Received | kernel.org |