CVE-2026-43502

A flaw was found in the Linux kernel, specifically within the Remote Direct Memory Access (RDMA) subsystem's handling of zerocopy send operations. When a zerocopy send fails before the message is attached to the sending socket, the kernel may incorrectly clean up the associated memory. This can lead to improper resource management, potentially causing system instability or denial of service.

An RDS zero copy send can fail after user pages were pinned but before the message is queued on a socket. The old purge logic inferred zero copy state from rm m_rs, so an unqueued message could be cleaned up with the wrong ownership model and leave pinned page accounting or notifier resources inconsistent. For the CVSS the PR:L is used because a local process may be able to reach the RDS sendmsg zero copy path when AF_RDS and zero copy support are available. The issue is not directly network reachable because the trigger is a local sendmsg failure path rather than packet receive processing. Impact is mainly denial of service through resource leak or pinned page accounting leak. No direct UAF, double free, arbitrary write, or privilege escalation primitive is shown by this patch.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.