net/rds: reset op_nents when zerocopy page pin fails

Summary

In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znotifier is cleared. But we fail to properly clear rm->data.op_nents. Later when rds_message_purge() is called from rds_sendmsg() the cleanup loop iterates over the incorrectly non zero number of op_nents and frees them again. Fix this by properly resetting op_nents when it should be in rds_message_zcopy_from_user().

Timeline

1. May 21, 2026, 10:49 AM UTCCVE published
2. Oct 16, 2026, 3:17 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: total

3. Oct 19, 2026, 7:26 PM UTCRecord last updated

Affected versions

• Linux Linux

  From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in c6e51512a784c4a7b86e1a044988696e3b3721fa; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in 03014551938a0887fa55f18ce49b70158a9c0113; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in d84ce1786ce40fdd3dd98db47aec5527817e1ef6; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in 9115669faedccdda100428e2d26fd0aac8c50799; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in 0bbbff00a15b1df2cac9014d6cf4b6890f473353; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in 640e37f58f991546a87540d067279c2c1fa9fe51; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in 290e833d1acb1093bc121fcdc97f5e6161157479; From 0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3 · fixed in e174929793195e0cd6a4adb0cad731b39f9019b4

• Linux Linux

  4.17

• KernelLinux

  From 4.17.0 · fixed in 5.10.258; From 5.11.0 · fixed in 5.15.209; From 5.16.0 · fixed in 6.1.175; From 6.2.0 · fixed in 6.6.141; From 6.7.0 · fixed in 6.12.91; From 6.13.0 · fixed in 6.18.33; From 6.19.0 · fixed in 7.0.10

References 9