CVE-2026-43128

A flaw was found in the Linux kernel's RDMA/umem subsystem. A memory management error, specifically a double unpin of a dma_buf, can occur in a failure path during dma_buf pinning operations. This vulnerability could lead to system instability or a crash, resulting in a Denial of Service (DoS).

RDMA pinned dmabuf setup can hit a failure path where ib_umem_dmabuf_map_pages fails after the dmabuf has been marked pinned. The old error path immediately called dma_buf_unpin but left the pinned state set, so the later ib_umem_release and revoke path could call dma_buf_unpin again on the same attachment. The issue is not network reachable by itself and is triggered through local RDMA memory registration paths. Impact is at least local denial of service via crash or corrupted pin state and in the worst case may allow confidentiality or integrity impact due to a dma buf lifetime imbalance and possible memory corruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.