Home

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again. Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).

PUBLISHED Reserved 2026-05-01 | Published 2026-05-06 | Updated 2026-05-08 | Assigner Linux




HIGH: 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Product status

Default status
unaffected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 70542b69abff34d24b11ae0bb200cc7a766d18df
affected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before b324327ff6f48d8065dca67eb3b91357e72726bd
affected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before ba3bf0f1bf1d5d0404678485e872980532fcc2c4
affected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf
affected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 40126bcbefa79ea86672e05dae608596bab38319
affected

1e4df4a21c5ac722df1099eee30cad9246c889b5 (git) before 104016eb671e19709721c1b0048dd912dc2e96be
affected

Default status
affected

5.16
affected

Any version before 5.16
unaffected

6.1.165 (semver)
unaffected

6.6.128 (semver)
unaffected

6.12.75 (semver)
unaffected

6.18.16 (semver)
unaffected

6.19.6 (semver)
unaffected

7.0 (original_commit_for_fix)
unaffected

References

git.kernel.org/...c/70542b69abff34d24b11ae0bb200cc7a766d18df

git.kernel.org/...c/b324327ff6f48d8065dca67eb3b91357e72726bd

git.kernel.org/...c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4

git.kernel.org/...c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf

git.kernel.org/...c/40126bcbefa79ea86672e05dae608596bab38319

git.kernel.org/...c/104016eb671e19709721c1b0048dd912dc2e96be

cve.org (CVE-2026-43128)

nvd.nist.gov (CVE-2026-43128)

Download JSON