AZL-87083
See a problem?- Import Source
- https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-87083.json
- JSON Data
- https://api.osv.dev/v1/vulns/AZL-87083
- Upstream
- Published
- 2026-05-21T12:16:19Z
- Modified
- 2026-08-28T17:47:37.345581508Z
- Summary
- CVE-2026-43494 affecting package kernel for versions less than 6.6.141.1-1
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
net/rds: reset op_nents when zerocopy page pin fails
When iovitergetpages2() fails in rdsmessagezcopyfromuser(), the pinned pages are released with putpage(), and rm->data.opmmpznotifier is cleared. But we fail to properly clear rm->data.op_nents.
Later when rdsmessagepurge() is called from rdssendmsg() the cleanup loop iterates over the incorrectly non zero number of opnents and frees them again.
Fix this by properly resetting opnents when it should be in rdsmessagezcopyfrom_user().
- References