CVE-2026-43120

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43120", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:55.987Z", "datePublished": "2026-05-06T07:40:43.923Z", "dateUpdated": "2026-10-19T19:06:14.514Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:04.967Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local RDMA uverbs operations on `/dev/infiniband/uverbs*`, specifically MR re-registration and deregistration. Remote RDMA/iWARP traffic does not invoke this userspace verbs callback.\nAC:L - No race or victim state is required; the same local process controls the MR, the `IB_MR_REREG_TRANS` request, and the subsequent deregistration that triggers the second release. Post-allocation failure can be induced through controlled MR parameters or irdma resource exhaustion, and uncertainty is resolved toward the higher severity option.\nPR:L - The attacker needs local access to an RDMA uverbs device and enough normal memlock allowance to register user memory, but the path does not require real root or administrative capabilities. RDMA core checks object ownership/netns access, not a high-privilege capability gate.\nUI:N - After obtaining local access, the attacker can issue the uverbs commands directly. No victim user action is required.\nS:U - The bug corrupts kernel memory within the same host kernel security authority. It is not a guest-to-host escape or other cross-scope boundary bypass.\nC:H - The stale `ib_umem` pointer creates a kernel heap use-after-free/double-free condition, and the second `ib_umem_release()` dereferences freed object fields. Such memory corruption can be leveraged for kernel information disclosure.\nI:H - The double release can corrupt allocator state and operate on attacker-reused `struct ib_umem` contents, providing a plausible path to arbitrary kernel memory corruption or code execution. Kernel UAF/double-free is therefore scored as high integrity impact.\nA:H - The second release of the same umem can crash or panic the kernel through invalid scatter-gather, DMA unmap, page unpin, refcount, or allocator operations. This gives high availability impact."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "versions": [{"version": "715fdb3b30541cc8180b7cdc6aa9f8c307afdf25", "lessThan": "62298a48f8b8788ad8b8464e6ffdf1ddebd2217e", "status": "affected", "versionType": "git"}, {"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "66964118f1f50ed85001c8fc9f7ab5bbdd021ee0", "status": "affected", "versionType": "git"}, {"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0f22c32141acdcda266b26cab2b830baf870f3e0", "status": "affected", "versionType": "git"}, {"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0c5d70bcb9d2275a1c8515a924016fcfeb4ab441", "status": "affected", "versionType": "git"}, {"version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2", "status": "affected", "versionType": "git"}, {"version": "6.6.120", "lessThan": "6.6.136", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "versions": [{"version": "6.7", "status": "affected"}, {"version": "0", "lessThan": "6.7", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.136", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.83", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.24", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.19.14", "lessThanOrEqual": "6.19.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.6.120", "versionEndExcluding": "6.6.136"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.12.83"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.18.24"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "6.19.14"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.7", "versionEndExcluding": "7.0"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"}, {"url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"}, {"url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"}, {"url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"}, {"url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"}], "title": "RDMA/irdma: Fix double free related to rereg_user_mr", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:52.649635Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T19:06:14.514Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43120", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:14:52.649635Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-415", "description": "CWE-415 Double Free"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:14:53.230Z"}}], "cna": {"title": "RDMA/irdma: Fix double free related to rereg_user_mr", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerable path is reached through local RDMA uverbs operations on `/dev/infiniband/uverbs*`, specifically MR re-registration and deregistration. Remote RDMA/iWARP traffic does not invoke this userspace verbs callback.\nAC:L - No race or victim state is required; the same local process controls the MR, the `IB_MR_REREG_TRANS` request, and the subsequent deregistration that triggers the second release. Post-allocation failure can be induced through controlled MR parameters or irdma resource exhaustion, and uncertainty is resolved toward the higher severity option.\nPR:L - The attacker needs local access to an RDMA uverbs device and enough normal memlock allowance to register user memory, but the path does not require real root or administrative capabilities. RDMA core checks object ownership/netns access, not a high-privilege capability gate.\nUI:N - After obtaining local access, the attacker can issue the uverbs commands directly. No victim user action is required.\nS:U - The bug corrupts kernel memory within the same host kernel security authority. It is not a guest-to-host escape or other cross-scope boundary bypass.\nC:H - The stale `ib_umem` pointer creates a kernel heap use-after-free/double-free condition, and the second `ib_umem_release()` dereferences freed object fields. Such memory corruption can be leveraged for kernel information disclosure.\nI:H - The double release can corrupt allocator state and operate on attacker-reused `struct ib_umem` contents, providing a plausible path to arbitrary kernel memory corruption or code execution. Kernel UAF/double-free is therefore scored as high integrity impact.\nA:H - The second release of the same umem can crash or panic the kernel through invalid scatter-gather, DMA unmap, page unpin, refcount, or allocator operations. This gives high availability impact."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "715fdb3b30541cc8180b7cdc6aa9f8c307afdf25", "lessThan": "62298a48f8b8788ad8b8464e6ffdf1ddebd2217e", "versionType": "git"}, {"status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "66964118f1f50ed85001c8fc9f7ab5bbdd021ee0", "versionType": "git"}, {"status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0f22c32141acdcda266b26cab2b830baf870f3e0", "versionType": "git"}, {"status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "0c5d70bcb9d2275a1c8515a924016fcfeb4ab441", "versionType": "git"}, {"status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "lessThan": "29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2", "versionType": "git"}, {"status": "affected", "version": "6.6.120", "lessThan": "6.6.136", "versionType": "semver"}], "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"status": "unaffected", "version": "0", "lessThan": "6.7", "versionType": "semver"}, {"status": "unaffected", "version": "6.6.136", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.83", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.24", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "6.19.14", "versionType": "semver", "lessThanOrEqual": "6.19.*"}, {"status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"}, {"url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"}, {"url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"}, {"url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"}, {"url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.136", "versionStartIncluding": "6.6.120"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0", "versionStartIncluding": "6.7"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:26:04.967Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43120", "state": "PUBLISHED", "dateUpdated": "2026-10-19T19:06:14.514Z", "dateReserved": "2026-05-01T14:12:55.987Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-06T07:40:43.923Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "62298a48f8b8788ad8b8464e6ffdf1ddebd2217e", "status": "affected", "version": "715fdb3b30541cc8180b7cdc6aa9f8c307afdf25", "versionType": "git"}, {"lessThan": "66964118f1f50ed85001c8fc9f7ab5bbdd021ee0", "status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "versionType": "git"}, {"lessThan": "0f22c32141acdcda266b26cab2b830baf870f3e0", "status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "versionType": "git"}, {"lessThan": "0c5d70bcb9d2275a1c8515a924016fcfeb4ab441", "status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "versionType": "git"}, {"lessThan": "29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2", "status": "affected", "version": "5ac388db27c443dadfbb0b8b23fa7ccf429d901a", "versionType": "git"}, {"lessThan": "6.6.136", "status": "affected", "version": "6.6.120", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/hw/irdma/verbs.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.7"}, {"lessThan": "6.7", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.136", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.83", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.24", "versionType": "semver"}, {"lessThanOrEqual": "6.19.*", "status": "unaffected", "version": "6.19.14", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.0", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "47055228-C2D7-4465-A276-87525D39743D", "versionEndExcluding": "6.6.136", "versionStartIncluding": "6.6.120", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "7F0AE5B5-23AC-4DCC-B37A-51CA1DAE7BA8", "versionEndExcluding": "6.12.83", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "8126B8B8-6D0B-4443-86C1-672AEE893555", "versionEndExcluding": "6.18.24", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D6A8A074-BBF4-4803-ABED-519A839435BB", "versionEndExcluding": "6.19.14", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:*", "matchCriteriaId": "F253B622-8837-4245-BCE5-A7BF8FC76A16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:*", "matchCriteriaId": "4AE85AD8-4641-4E7C-A2F4-305E2CD9EE64", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:*", "matchCriteriaId": "F666C8D8-6538-46D4-B318-87610DE64C34", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:*", "matchCriteriaId": "02259FDA-961B-47BC-AE7F-93D7EC6E90C2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:*", "matchCriteriaId": "58A9FEFF-C040-420D-8F0A-BFDAAA1DF258", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")"}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nRDMA/irdma: Soluci\u00f3n para una doble liberaci\u00f3n relacionada con rereg_user_mr\n\nSi IB_MR_REREG_TRANS se establece durante rereg_user_mr, el umem ser\u00e1 liberado y se asignar\u00e1 uno nuevo en irdma_rereg_mr_trans. Si alg\u00fan paso de irdma_rereg_mr_trans falla despu\u00e9s de que el nuevo umem sea asignado, libera el umem, pero no establece iwmr -> region en NULL. El problema es que este fallo se propaga al usuario, quien luego llamar\u00e1 a ibv_dereg_mr (como deber\u00eda). Entonces, la ruta de dereg_mr ver\u00e1 un umem no-NULL e intentar\u00e1 llamar a ib_umem_release de nuevo.\n\nSolucione esto estableciendo iwmr -> region en NULL despu\u00e9s de ib_umem_release.\n\nCorregido: 5ac388db27c4 (\u2019RDMA/irdma: A\u00f1adir soporte para volver a registrar una regi\u00f3n de memoria\u2019)"}], "id": "CVE-2026-43120", "lastModified": "2026-11-11T21:10:00.200", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43120", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:14:52.649635Z", "version": "2.0.3"}}]}, "published": "2026-05-06T10:16:25.913", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-415"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-415"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: RDMA/irdma: Fix double free related to rereg_user_mr", "id": "2467012", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467012"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-1341", "details": ["A flaw was found in the Linux kernel's RDMA (Remote Direct Memory Access) irdma driver. This vulnerability, a double free, occurs during the re-registration of user memory regions. If an internal memory re-registration operation fails, the system attempts to free the same memory twice. This could allow a local attacker to cause memory corruption, potentially leading to a system crash (denial of service)."], "name": "CVE-2026-43120", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43120\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43120\nhttps://lore.kernel.org/linux-cve-announce/2026050628-CVE-2026-43120-80f4@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,62298a48f8b8788ad8b8464e6ffdf1ddebd2217e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,66964118f1f50ed85001c8fc9f7ab5bbdd021ee0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0f22c32141acdcda266b26cab2b830baf870f3e0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,0c5d70bcb9d2275a1c8515a924016fcfeb4ab441)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.136,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.83,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.24,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.19.14,6.19.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-06T12:45:03.593681+00:00", "updated": "2026-05-12T22:30:05.528103+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}