{"id":"CVE-2026-43120","revision":"59d1204ba73c4374874ed53152b6e51b","records":[{"revision":"59d1204ba73c4374874ed53152b6e51b","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-43120","aliases":[],"title":"RDMA/irdma: Fix double free related to rereg_user_mr","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/irdma: Fix double free related to rereg_user_mr\n\nIf IB_MR_REREG_TRANS is set during rereg_user_mr, the\numem will be released and a new one will be allocated\nin irdma_rereg_mr_trans. If any step of irdma_rereg_mr_trans\nfails after the new umem is allocated, it releases the umem,\nbut does not set iwmr->region to NULL. The problem is that\nthis failure is propagated to the user, who will then call\nibv_dereg_mr (as they should). Then, the dereg_mr path will\nsee a non-NULL umem and attempt to call ib_umem_release again.\n\nFix this by setting iwmr->region to NULL after ib_umem_release.\n\nFixed: 5ac388db27c4 (\"RDMA/irdma: Add support to re-register a memory region\")","state":0,"publishedAt":"2026-05-06T07:40:43.923+00:00","modifiedAt":"2026-10-19T19:06:14.514+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"unaffected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/irdma/verbs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"715fdb3b30541cc8180b7cdc6aa9f8c307afdf25\",\n                            \"lessThan\": \"62298a48f8b8788ad8b8464e6ffdf1ddebd2217e\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac388db27c443dadfbb0b8b23fa7ccf429d901a\",\n                            \"lessThan\": \"66964118f1f50ed85001c8fc9f7ab5bbdd021ee0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac388db27c443dadfbb0b8b23fa7ccf429d901a\",\n                            \"lessThan\": \"0f22c32141acdcda266b26cab2b830baf870f3e0\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac388db27c443dadfbb0b8b23fa7ccf429d901a\",\n                            \"lessThan\": \"0c5d70bcb9d2275a1c8515a924016fcfeb4ab441\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"5ac388db27c443dadfbb0b8b23fa7ccf429d901a\",\n                            \"lessThan\": \"29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"git\"\n                        },\n                        {\n                            \"version\": \"6.6.120\",\n                            \"lessThan\": \"6.6.136\",\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\"\n                        }\n                    ]\n                }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"product\": \"Linux\",\n                    \"vendor\": \"Linux\",\n                    \"defaultStatus\": \"affected\",\n                    \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n                    \"programFiles\": [\n                        \"drivers/infiniband/hw/irdma/verbs.c\"\n                    ],\n                    \"versions\": [\n                        {\n                            \"version\": \"6.7\",\n                            \"status\": \"affected\"\n                        },\n                        {\n                            \"version\": \"0\",\n                            \"lessThan\": \"6.7\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.6.136\",\n                            \"lessThanOrEqual\": \"6.6.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.12.83\",\n                            \"lessThanOrEqual\": \"6.12.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.18.24\",\n                            \"lessThanOrEqual\": \"6.18.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"6.19.14\",\n                            \"lessThanOrEqual\": \"6.19.*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"semver\"\n                        },\n                        {\n                            \"version\": \"7.0\",\n                            \"lessThanOrEqual\": \"*\",\n                            \"status\": \"unaffected\",\n                            \"versionType\": \"original_commit_for_fix\"\n                        }\n                    ]\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/62298a48f8b8788ad8b8464e6ffdf1ddebd2217e","https://git.kernel.org/stable/c/66964118f1f50ed85001c8fc9f7ab5bbdd021ee0","https://git.kernel.org/stable/c/0f22c32141acdcda266b26cab2b830baf870f3e0","https://git.kernel.org/stable/c/0c5d70bcb9d2275a1c8515a924016fcfeb4ab441","https://git.kernel.org/stable/c/29a3edd7004bb635d299fb9bc6f0ea4ef13ed5a2"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-43120","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-43120","identifiers":["CVE-2026-43120"]},"retained":false,"historicalAffected":[]}],"coverage":[]}