CVE-2026-43502

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-43502", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-05-01T14:12:56.014Z", "datePublished": "2026-05-21T12:17:50.444Z", "dateUpdated": "2026-10-15T01:19:32.714Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:25.250Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm->m_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by a local sendmsg(MSG_ZEROCOPY) syscall on an AF_RDS socket; the buggy cleanup decision depends only on local send-side failure conditions, not on any data received from a remote peer.\nAC:L - The attacker fully and deterministically controls the pre-queue failure (e.g., nonblocking socket with a full send buffer, or an invalid RDMA/atomic cmsg), so no race or uncontrolled condition is involved.\nPR:L - Creating an AF_RDS SOCK_SEQPACKET socket and enabling SO_ZEROCOPY require no capabilities (rds_create has no privilege check), so any unprivileged local user can reach the code.\nUI:N - The attacker triggers the entire flow through its own syscall; no action by another user is required.\nS:U - The memory corruption stays within the kernel's own security authority and does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - Releasing GUP-pinned user pages through the wrong path (and underflowing compound-page refcounts) can free/reuse pages still owned by user space, enabling disclosure of memory contents after reuse.\nI:H - The struct-page refcount underflow and improper page free constitute memory corruption that can be leveraged into a page use-after-free/write primitive, not merely a clean crash.\nA:H - The corrupted page accounting/refcounting and improper buddy-allocator free can cause VM_BUG_ON, oops, or kernel panic, in addition to leaking pinned-page accounting and the notifier struct."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/message.c"], "versions": [{"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b", "status": "affected", "versionType": "git"}, {"version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "44b550d88b267320459d518c0743a241ab2108fa", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/rds/message.c"], "versions": [{"version": "4.17", "status": "affected"}, {"version": "0", "lessThan": "4.17", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.258", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.209", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.175", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.140", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.88", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.30", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.7", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.10.258"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "5.15.209"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.1.175"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.6.140"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.12.88"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "6.18.30"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.0.7"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "4.17", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9"}, {"url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f"}, {"url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24"}, {"url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e"}, {"url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46"}, {"url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e"}, {"url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b"}, {"url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa"}], "title": "net/rds: handle zerocopy send cleanup before the message is queued", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-401", "lang": "en", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "references": [{"url": "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43502-openSUSE-6.4.0-150600", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-09-14T00:00:00+00:00", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3", "id": "CVE-2026-43502"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-15T03:56:01.157Z"}}, {"x_adpType": "supplier", "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:19:32.714Z"}, "affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"affected": [{"vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [{"status": "affected", "version": "0", "lessThan": "*", "versionType": "custom"}], "defaultStatus": "unknown"}], "x_adpType": "supplier", "references": [{"url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}], "providerMetadata": {"orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-10-15T01:19:32.714Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-43502", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-09-14T14:09:05.627504Z"}}}], "references": [{"url": "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43502-openSUSE-6.4.0-150600", "tags": ["exploit"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-401", "description": "CWE-401 Missing Release of Memory after Effective Lifetime"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-09-14T14:07:09.544Z"}}], "cna": {"title": "net/rds: handle zerocopy send cleanup before the message is queued", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered by a local sendmsg(MSG_ZEROCOPY) syscall on an AF_RDS socket; the buggy cleanup decision depends only on local send-side failure conditions, not on any data received from a remote peer.\nAC:L - The attacker fully and deterministically controls the pre-queue failure (e.g., nonblocking socket with a full send buffer, or an invalid RDMA/atomic cmsg), so no race or uncontrolled condition is involved.\nPR:L - Creating an AF_RDS SOCK_SEQPACKET socket and enabling SO_ZEROCOPY require no capabilities (rds_create has no privilege check), so any unprivileged local user can reach the code.\nUI:N - The attacker triggers the entire flow through its own syscall; no action by another user is required.\nS:U - The memory corruption stays within the kernel's own security authority and does not cross into another security scope such as a VM or IOMMU boundary.\nC:H - Releasing GUP-pinned user pages through the wrong path (and underflowing compound-page refcounts) can free/reuse pages still owned by user space, enabling disclosure of memory contents after reuse.\nI:H - The struct-page refcount underflow and improper page free constitute memory corruption that can be leveraged into a page use-after-free/write primitive, not merely a clean crash.\nA:H - The corrupted page accounting/refcounting and improper buddy-allocator free can cause VM_BUG_ON, oops, or kernel panic, in addition to leaking pinned-page accounting and the notifier struct."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b", "versionType": "git"}, {"status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "lessThan": "44b550d88b267320459d518c0743a241ab2108fa", "versionType": "git"}], "programFiles": ["net/rds/message.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"status": "unaffected", "version": "0", "lessThan": "4.17", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.258", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.209", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.175", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.140", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.88", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.30", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.7", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/rds/message.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9"}, {"url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f"}, {"url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24"}, {"url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e"}, {"url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46"}, {"url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e"}, {"url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b"}, {"url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm->m_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.209", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.175", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.140", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.88", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.30", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.7", "versionStartIncluding": "4.17"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "4.17"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:28:25.250Z"}}}, "cveMetadata": {"cveId": "CVE-2026-43502", "state": "PUBLISHED", "dateUpdated": "2026-10-15T01:19:32.714Z", "dateReserved": "2026-05-01T14:12:56.014Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-05-21T12:17:50.444Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/rds/message.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}, {"lessThan": "44b550d88b267320459d518c0743a241ab2108fa", "status": "affected", "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/rds/message.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "4.17"}, {"lessThan": "4.17", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.258", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.209", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.175", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.140", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.88", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.30", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.7", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"affectedData": [{"defaultStatus": "unknown", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "vendor": "Siemens", "versions": [{"lessThan": "*", "status": "affected", "version": "0", "versionType": "custom"}]}], "source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "CF9EFBB4-E004-479B-A237-DECC87FD4D0E", "versionEndExcluding": "5.10.258", "versionStartIncluding": "4.17", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4", "versionEndExcluding": "5.15.209", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA", "versionEndExcluding": "6.1.175", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D", "versionEndExcluding": "6.6.140", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4", "versionEndExcluding": "6.12.88", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B", "versionEndExcluding": "6.18.30", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E", "versionEndExcluding": "7.0.7", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm->m_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."}, {"lang": "es", "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/rds: manejar la limpieza de env\u00edo de zerocopy antes de que el mensaje sea encolado\n\nUn env\u00edo zerocopy puede fallar despu\u00e9s de que las p\u00e1ginas de usuario hayan sido fijadas pero antes de que el mensaje sea adjuntado al socket de env\u00edo.\n\nLa ruta de purga actualmente infiere el estado zerocopy de rm->m_rs, por lo que un mensaje no encolado puede ser limpiado como si poseyera p\u00e1ginas de carga \u00fatil normales. Sin embargo, la propiedad zerocopy es realmente determinada por la presencia de op_mmp_znotifier, independientemente de si el mensaje ha llegado a la cola del socket.\n\nCapturar op_mmp_znotifier de antemano en rds_message_purge() y usarlo como discriminador de limpieza. Si el mensaje ya est\u00e1 asociado con un socket, mantener la ruta de finalizaci\u00f3n existente. De lo contrario, descartar la contabilidad de p\u00e1ginas fijadas directamente y liberar el notificador antes de colocar las p\u00e1ginas de carga \u00fatil.\n\nEsto mantiene la limpieza temprana de fallos de env\u00edo consistente con las reglas de vida \u00fatil de zerocopy sin cambiar la ruta de finalizaci\u00f3n encolada normal."}], "id": "CVE-2026-43502", "lastModified": "2026-10-15T02:19:34.990", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-43502", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-09-14T00:00:00+00:00", "version": "2.0.3"}}]}, "published": "2026-05-21T13:16:19.520", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9"}, {"source": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "url": "https://cert-portal.siemens.com/productcert/html/ssa-784472.html"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43502-openSUSE-6.4.0-150600"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-401"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: net/rds: handle zerocopy send cleanup before the message is queued", "id": "2480456", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2480456"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "draft"}, "cwe": "CWE-459", "details": ["A flaw was found in the Linux kernel, specifically within the Remote Direct Memory Access (RDMA) subsystem's handling of zerocopy send operations. When a zerocopy send fails before the message is attached to the sending socket, the kernel may incorrectly clean up the associated memory. This can lead to improper resource management, potentially causing system instability or denial of service."], "name": "CVE-2026-43502", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-05-21T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-43502\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-43502\nhttps://lore.kernel.org/linux-cve-announce/2026052159-CVE-2026-43502-01ec@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,21d70744e6d3bbf9293aa1ee6fba7c53ad75275e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,3abc8983b2bae3f487f77d9da5527d7d6b210d46)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,14ef6fd18db2494098b21e0471bf27a1d8e9993e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3,44b550d88b267320459d518c0743a241ab2108fa)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "4.17"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,4.17)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.140,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.88,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.30,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.7,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1-rc3,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-05-21T14:00:12.571530+00:00", "updated": "2026-09-21T08:45:12.892480+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}