https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 30 Sep 2026 02:39:59 +0000 https://vulnerability.circl.lu/vuln/cve-2026-43494 <p><strong>Affected:</strong> Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/rds: reset op_nents when zerocopy page pin fails</p> <p>When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm-&gt;data.op_mmp_znotifier is cleared. But we fail to properly clear rm-&gt;data.op_nents.</p> <p>Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again.</p> <p>Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().</p> <p><strong>Affected:</strong> Linux, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 7, Red Hat Enterprise Linux 8, Red Hat Enterprise Linux 9</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>net/rds: reset op_nents when zerocopy page pin fails</p> <p>When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm-&gt;data.op_mmp_znotifier is cleared. But we fail to properly clear rm-&gt;data.op_nents.</p> <p>Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again.</p> <p>Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().</p> https://vulnerability.circl.lu/vuln/cve-2026-43494