Go to homepageCyberStrike

Menu

Star on GitHub · 3.2k
Sign inDownload

CVE-2026-43128

7.8 · HIGH

In the Linux kernel, the following vulnerability has been resolved: RDMA/umem: Fix double dma_buf_unpin in failure path In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to ib_umem_dmabuf_…

Published May 6, 2026CWE-415EPSS 0.18%

Overview

CVE-2026-43128 is a high-severity vulnerability. It was published on May 6, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dma_buf_unpin in failure path

In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to

ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf

is immediately unpinned but the umem_dmabuf->pinned flag is still

set. Then, when ib_umem_release() is called, it calls

ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let

the ib_umem_release/revoke path handle it. This also ensures the

proper unmap-unpin unwind ordering if the dmabuf_map_pages call

happened to fail due to dma_resv_wait_timeout (and therefore has

a non-NULL umem_dmabuf->sgt).

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References

Refgit.kernel.org/stable/c/104016eb671e19709721c1b0048dd912dc2e96beRefgit.kernel.org/stable/c/40126bcbefa79ea86672e05dae608596bab38319Refgit.kernel.org/stable/c/70542b69abff34d24b11ae0bb200cc7a766d18dfRefgit.kernel.org/stable/c/b324327ff6f48d8065dca67eb3b91357e72726bdRefgit.kernel.org/stable/c/ba3bf0f1bf1d5d0404678485e872980532fcc2c4Refgit.kernel.org/stable/c/d3e32e2f3262f1b25d77c085ace38e2cc4ad75cf

How CyberStrike helps

Frequently asked questions

What is CVE-2026-43128?

CVE-2026-43128 is a high-severity vulnerability. It was published on May 6, 2026 and has a CVSS 3.1 base score of 7.8 (HIGH).

How severe is CVE-2026-43128?

This vulnerability has a CVSS 3.1 base score of 7.8, rated HIGH. It requires local or adjacent network access to exploit. Some level of privileges is required for exploitation.

How do I fix or remediate CVE-2026-43128?

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

How can CyberStrike help with CVE-2026-43128?

CyberStrike is an open-source, AI-augmented pentesting engine. Rather than flag a version number, it tests whether an issue like CVE-2026-43128 is actually reachable in your own applications and APIs, then verifies each finding before reporting it. That tells you if the weakness is a real, exploitable risk in your environment or a false positive you can safely deprioritize.

Related HIGH CVEs from 2026

View all
Browse by year2026202520242023202220212020201920182017201620152014201320122011201020092008200720062005200420032002200120001999