Executive brief
A vulnerability was identified in the Linux kernel's Reliable Datagram Sockets (RDS) protocol, which is used for high-performance data transfers. A flaw in how the system handles memory mapping errors could lead to a system crash or instability. This issue occurs when the kernel incorrectly attempts to free memory resources twice during a failed operation.
Technical details
A double-free vulnerability exists in the Linux kernel RDS (Reliable Datagram Sockets) subsystem within the `__rds_rdma_map()` function in `net/rds/rdma.c`. The issue occurs when `get_mr()` succeeds, handing ownership of scatter-gather pages to the transport, but a subsequent `put_user()` call fails while copying the RDMA cookie back to user space. In this error scenario, the code incorrectly attempted to unpin and free the pages again, despite the transport already being responsible for them. This duplicate cleanup can lead to memory corruption or a kernel panic. The fix removes the redundant `unpin_user_pages` and `kfree` calls from the `put_user` failure branch, ensuring teardown is managed solely by the final cleanup path.
Affected products
- Linux Linux kernel All versions prior to the fix in May 2026
Timeline
- 2026-04-22: other: Patch authored
- 2026-05-27: disclosed: CVE published
- 2026-05-07: patched: Fix committed to stable branches
References
- https://git.kernel.org/stable/c/033370ffb3c9c0264d19f8ba9ef769523266589a
- https://git.kernel.org/stable/c/8141a2dc70080eda1aedc0389ed2db2b292af5bd
- https://git.kernel.org/stable/c/8fdbb6262a4a3ed44a0830a7793903b54bb27bdc
- https://git.kernel.org/stable/c/b3cb8cae530b2727d8245684148bb49425f6765c
- https://git.kernel.org/stable/c/d95cea9298be1ba8876e3f156be96d3a492085ca