CVE-2026-43128 RDMA/umem: Fix double dma_buf_unpin in failure path
A double unpin vulnerability in the Linux kernel RDMA subsystem allows attackers to cause denial of service or potentially execute code via crafted DMA buffer operations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43128?
CVE-2026-43128 is a high-severity memory corruption vulnerability in Linux kernel, published on 6 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
RDMA/umem: Fix double dma_buf_unpin in failure path
In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf is immediately unpinned but the umem_dmabuf->pinned flag is still set. Then, when ib_umem_release() is called, it calls ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.
Fix this by removing the immediate unpin upon failure and just let the ib_umem_release/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabuf_map_pages call happened to fail due to dma_resv_wait_timeout (and therefore has a non-NULL umem_dmabuf->sgt).
Weakness: CWE-415
Which versions are affected by CVE-2026-43128?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43128?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43128 being exploited?
There is no known exploitation of CVE-2026-43128 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-43128, DEBIAN-CVE-2026-43128, GHSA-6g84-hfm2-x43x, ROOT-OS-UBUNTU-2404-CVE-2026-43128, UBUNTU-CVE-2026-43128.