NetSight
IP …
high7.8

CVE-2026-46053

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix MR cleanup on copy error __rds_rdma_map() hands sg/pages ownership to the tra…

Impact

In the Linux kernel, the following vulnerability has been resolved: net: rds: fix MR cleanup on copy error __rds_rdma_map() hands sg/pages ownership to the transport after get_mr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference. Remove the duplicate unpin/free from the put_user() failure branch so that MR teardown is handled only through the existing final cleanup path.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.6.1 before 5.10.258
from 5.11 before 5.15.209
from 5.16 before 6.1.175
from 6.2 before 6.6.140
from 6.7 before 6.12.86
from 6.13 before 6.18.27

References