CVE-2026-43120
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2026
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
RDMA/irdma: Fix double free related to rereg_user_mr
In the Linux kernel, the following vulnerability has been resolved: RDMA/irdma: Fix double free related to rereg_user_mr If IB_MR_REREG_TRANS is set during rereg_user_mr, the umem will be released and a new one will be allocated in irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans fails after the new umem is allocated, it releases the umem, but does not set iwmr->region to NULL. The problem is that this failure is propagated to the user, who will then call ibv_dereg_mr (as they should). Then, the dereg_mr path will see a non-NULL umem and attempt to call ib_umem_release again. Fix this by setting iwmr->region to NULL after ib_umem_release. Fixed: 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 715fdb3b30541cc8180b7cdc6aa9f8c307afdf25 | affected | git | 62298a48f8b8788ad8b8464e6ffdf1ddebd2217e | Unavailable | None listed |
| 5ac388db27c443dadfbb0b8b23fa7ccf429d901a | affected | git | 66964118f1f50ed85001c8fc9f7ab5bbdd021ee0 | Unavailable | None listed |
| 5ac388db27c443dadfbb0b8b23fa7ccf429d901a | affected | git | 0f22c32141acdcda266b26cab2b830baf870f3e0 | Unavailable | None listed |
| 5ac388db27c443dadfbb0b8b23fa7ccf429d901a | affected | git | 0c5d70bcb9d2275a1c8515a924016fcfeb4ab441 | Unavailable | None listed |
| 5ac388db27c443dadfbb0b8b23fa7ccf429d901a | affected | git | 29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2 | Unavailable | None listed |
| 6.6.120 | affected | semver | 6.6.136 | Unavailable | None listed |
Linux
- Vendor
- Linux
- Product
- Linux
- Platforms
- Unknown
- Default status
affected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| 6.7 | affected | Unavailable | Unavailable | Unavailable | None listed |
| 0 | unaffected | semver | 6.7 | Unavailable | None listed |
| 6.6.136 | unaffected | semver | Unavailable | 6.6.* | None listed |
| 6.12.83 | unaffected | semver | Unavailable | 6.12.* | None listed |
| 6.18.24 | unaffected | semver | Unavailable | 6.18.* | None listed |
| 6.19.14 | unaffected | semver | Unavailable | 6.19.* | None listed |
| 7.0 | unaffected | original_commit_for_fix | Unavailable | * | None listed |