CVE-2026-43120: Linux Kernel RDMA Use-After-Free Issue

CVE-2026-43120 Overview

CVE-2026-43120 is a double free vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) irdma driver. The flaw resides in the irdma_rereg_mr_trans function used during memory region re-registration. When IB_MR_REREG_TRANS is set, the existing umem is released and a new one allocated. If subsequent steps fail, the function releases the new umem without setting iwmr->region to NULL. The failure propagates to userspace, prompting the application to call ibv_dereg_mr, which triggers a second ib_umem_release on the same memory.

Critical Impact
A double free in kernel memory management can lead to kernel memory corruption, potential privilege escalation, or denial of service on systems using Intel irdma RDMA hardware.

Affected Products

Linux kernel versions containing commit 5ac388db27c4 ("RDMA/irdma: Add support to re-register a memory region")
Systems using the Intel irdma RDMA driver
Distributions shipping vulnerable kernel branches prior to the referenced stable patches

Discovery Timeline

2026-05-06 - CVE-2026-43120 published to NVD
2026-05-06 - Last updated in NVD database

Technical Details for CVE-2026-43120

Vulnerability Analysis

The vulnerability is a double free [CWE-415] in the Linux kernel irdma driver's memory region re-registration path. Memory regions in RDMA represent pinned user buffers that hardware can access directly. Re-registration allows a process to update an existing region rather than creating a new one.

When IB_MR_REREG_TRANS is set, irdma_rereg_mr_trans releases the original umem and allocates a replacement. If any subsequent step fails, the error path calls ib_umem_release on the new umem but leaves iwmr->region pointing at the freed object. The error returns to userspace, where the application correctly invokes ibv_dereg_mr to clean up. The kernel dereg_mr handler observes a non-NULLiwmr->region and calls ib_umem_release a second time on already-freed memory.

Root Cause

The root cause is missing state cleanup on an error path. The function frees the umem but does not nullify the cached pointer iwmr->region. This violates the invariant that freed pointers must not remain reachable. The fix sets iwmr->region = NULL immediately after ib_umem_release.

Attack Vector

Exploitation requires a local user with permission to open an RDMA device and register memory regions. The attacker triggers a re-registration with IB_MR_REREG_TRANS, induces a failure in the post-allocation path, and then deregisters the memory region. The second free can corrupt the kernel slab allocator state, potentially enabling further memory corruption primitives.

No verified public exploit code is available. Refer to the upstream commits for the patch details: Kernel Git Commit 0c5d70b and Kernel Git Commit 66964118.

Detection Methods for CVE-2026-43120

Indicators of Compromise

Kernel oops or panic messages referencing ib_umem_release, irdma_dereg_mr, or slab use-after-free splats
KASAN reports flagging double-free conditions in the irdma module
Unexpected RDMA application crashes following ibv_rereg_mr failures

Detection Strategies

Audit running kernel versions across hosts with Intel irdma-capable NICs and compare against patched stable releases
Enable CONFIG_KASAN in test environments to catch double free conditions during RDMA workload testing
Monitor dmesg and syslog for RDMA subsystem errors and slab allocator warnings

Monitoring Recommendations

Collect kernel ring buffer logs centrally and alert on ib_umem_release stack traces
Track loaded kernel module versions with endpoint telemetry to identify unpatched irdma instances
Correlate process crashes from RDMA-using workloads (storage, HPC, AI training) with kernel error events

How to Mitigate CVE-2026-43120

Immediate Actions Required

Inventory all Linux hosts running the irdma driver, including HPC, AI training clusters, and NVMe-over-Fabrics storage nodes
Apply the upstream stable kernel patches that set iwmr->region = NULL after ib_umem_release in the error path
Restrict access to RDMA device files (/dev/infiniband/*) to trusted users and service accounts

Patch Information

The fix is delivered through multiple stable kernel branches. Reference the upstream commits: Kernel Git Commit 0c5d70b, Kernel Git Commit 0f22c32, Kernel Git Commit 29a3edd, Kernel Git Commit 62298a4, and Kernel Git Commit 66964118. Coordinate with your distribution vendor for backported packages.

Workarounds

Unload the irdma module on systems that do not require RDMA functionality using modprobe -r irdma
Blacklist the irdma module in /etc/modprobe.d/ where RDMA is not in use
Limit user access to RDMA verbs interfaces and avoid running untrusted workloads on hosts exposing irdma devices

bash

# Configuration example: blacklist irdma where RDMA is not required
echo "blacklist irdma" | sudo tee /etc/modprobe.d/blacklist-irdma.conf
sudo modprobe -r irdma

# Verify kernel version after patching
uname -r

# Restrict access to RDMA device nodes
sudo chmod 0660 /dev/infiniband/*
sudo chown root:rdma /dev/infiniband/*