« Volver al listado

CVE-2026-43502

Estado: ModificadaAlta (7.8)—

In the Linux kernel, the following vulnerability has been resolved:

net/rds: handle zerocopy send cleanup before the message is queued

A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket.

The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue.

Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path.

Leer descripción completaMostrar menos

Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages.

This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

Vulnerabilidad local (AV:L/PR:L) en kernel Linux que permite DoS por mal manejo de memoria zerocopy; CWE-401 (gestión de recursos) confirma corrupción de estado que causa negación de servicio.

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Threat Intelligence ProgramFilter Network TrafficExecution PreventionApplication Isolation and SandboxingExploit ProtectionUpdate Software

Tecnologías afectadas (1)

Linux — Linux Kernel

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-43502",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-43502",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-09-14T00:00:00+00:00"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "e9aefdc5c53fe9aed108c14e3d155710a1bb14c9",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "46662f7dc59475995609bf3e9d27eb36f4acf26f",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "1e262db7675e27f42c3f3f47d6011855f4454f24",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "21d70744e6d3bbf9293aa1ee6fba7c53ad75275e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "3abc8983b2bae3f487f77d9da5527d7d6b210d46",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "14ef6fd18db2494098b21e0471bf27a1d8e9993e",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b",
              "versionType": "git"
            },
            {
              "status": "affected",
              "version": "0cebaccef3acbdfbc2d85880a2efb765d2f4e2e3",
              "lessThan": "44b550d88b267320459d518c0743a241ab2108fa",
              "versionType": "git"
            }
          ],
          "programFiles": [
            "net/rds/message.c"
          ],
          "defaultStatus": "unaffected"
        },
        {
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "product": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.17"
            },
            {
              "status": "unaffected",
              "version": "0",
              "lessThan": "4.17",
              "versionType": "semver"
            },
            {
              "status": "unaffected",
              "version": "5.10.258",
              "versionType": "semver",
              "lessThanOrEqual": "5.10.*"
            },
            {
              "status": "unaffected",
              "version": "5.15.209",
              "versionType": "semver",
              "lessThanOrEqual": "5.15.*"
            },
            {
              "status": "unaffected",
              "version": "6.1.175",
              "versionType": "semver",
              "lessThanOrEqual": "6.1.*"
            },
            {
              "status": "unaffected",
              "version": "6.6.140",
              "versionType": "semver",
              "lessThanOrEqual": "6.6.*"
            },
            {
              "status": "unaffected",
              "version": "6.12.88",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "status": "unaffected",
              "version": "6.18.30",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "status": "unaffected",
              "version": "7.0.7",
              "versionType": "semver",
              "lessThanOrEqual": "7.0.*"
            },
            {
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ],
          "programFiles": [
            "net/rds/message.c"
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-21T13:16:19.520",
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/14ef6fd18db2494098b21e0471bf27a1d8e9993e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/1e262db7675e27f42c3f3f47d6011855f4454f24",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/21d70744e6d3bbf9293aa1ee6fba7c53ad75275e",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/3abc8983b2bae3f487f77d9da5527d7d6b210d46",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/44b550d88b267320459d518c0743a241ab2108fa",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/46662f7dc59475995609bf3e9d27eb36f4acf26f",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e9aefdc5c53fe9aed108c14e3d155710a1bb14c9",
      "tags": [
        "Patch"
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://github.com/NebuSec/CyberMeowfia/tree/main/security-research/Linux-CVE-2026-43502-openSUSE-6.4.0-150600",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "description": [
        {
          "lang": "en",
          "value": "CWE-401"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet/rds: handle zerocopy send cleanup before the message is queued\n\nA zerocopy send can fail after user pages have been pinned but before\nthe message is attached to the sending socket.\n\nThe purge path currently infers zerocopy state from rm->m_rs, so an\nunqueued message can be cleaned up as if it owned normal payload pages.\nHowever, zerocopy ownership is really determined by the presence of\nop_mmp_znotifier, regardless of whether the message has reached the\nsocket queue.\n\nCapture op_mmp_znotifier up front in rds_message_purge() and use it as\nthe cleanup discriminator. If the message is already associated with a\nsocket, keep the existing completion path. Otherwise, drop the pinned\npage accounting directly and release the notifier before putting the\npayload pages.\n\nThis keeps early send failure cleanup consistent with the zerocopy\nlifetime rules without changing the normal queued completion path."
    },
    {
      "lang": "es",
      "value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nnet/rds: manejar la limpieza de envío de zerocopy antes de que el mensaje sea encolado\n\nUn envío zerocopy puede fallar después de que las páginas de usuario hayan sido fijadas pero antes de que el mensaje sea adjuntado al socket de envío.\n\nLa ruta de purga actualmente infiere el estado zerocopy de rm->m_rs, por lo que un mensaje no encolado puede ser limpiado como si poseyera páginas de carga útil normales. Sin embargo, la propiedad zerocopy es realmente determinada por la presencia de op_mmp_znotifier, independientemente de si el mensaje ha llegado a la cola del socket.\n\nCapturar op_mmp_znotifier de antemano en rds_message_purge() y usarlo como discriminador de limpieza. Si el mensaje ya está asociado con un socket, mantener la ruta de finalización existente. De lo contrario, descartar la contabilidad de páginas fijadas directamente y liberar el notificador antes de colocar las páginas de carga útil.\n\nEsto mantiene la limpieza temprana de fallos de envío consistente con las reglas de vida útil de zerocopy sin cambiar la ruta de finalización encolada normal."
    }
  ],
  "lastModified": "2026-09-15T04:18:04.333",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CF9EFBB4-E004-479B-A237-DECC87FD4D0E",
              "versionEndExcluding": "5.10.258",
              "versionStartIncluding": "4.17"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "919C10A9-7951-4A74-BADD-C135A0A8D8B4",
              "versionEndExcluding": "5.15.209",
              "versionStartIncluding": "5.11"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "92385813-D91D-480D-83A1-F423D2CBB2BA",
              "versionEndExcluding": "6.1.175",
              "versionStartIncluding": "5.16"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A1A92866-F406-43B5-B2D1-CFC274753E9D",
              "versionEndExcluding": "6.6.140",
              "versionStartIncluding": "6.2"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5AFBE0EC-CCDF-4207-AE92-ABF958125CA4",
              "versionEndExcluding": "6.12.88",
              "versionStartIncluding": "6.7"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BF39AE08-AE6D-4410-8FBE-76F6BF5BF55B",
              "versionEndExcluding": "6.18.30",
              "versionStartIncluding": "6.13"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "D0893CA7-9AE6-4DFE-AC75-48967D73AD8E",
              "versionEndExcluding": "7.0.7",
              "versionStartIncluding": "6.19"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390"
            },
            {
              "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}