CVE-2026-43128 Overview
CVE-2026-43128 is a Linux kernel vulnerability in the RDMA (Remote Direct Memory Access) subsystem. The flaw resides in the ib_umem_dmabuf_get_pinned_with_dma_device() function within the user memory (umem) handling code. When ib_umem_dmabuf_map_pages() fails, the dmabuf is immediately unpinned while the umem_dmabuf->pinned flag remains set. A subsequent call to ib_umem_release() invokes ib_umem_dmabuf_revoke(), which calls dma_buf_unpin() a second time on the same buffer.
The vulnerability has been resolved in the upstream Linux kernel through commits in the stable tree.
Critical Impact
A double dma_buf_unpin call in the failure path of RDMA umem handling can corrupt kernel reference counters and trigger kernel instability on systems using RDMA with dmabuf-backed memory regions.
Affected Products
- Linux kernel (RDMA/InfiniBand umem subsystem)
- Systems using RDMA with dma_buf integration
- Distributions shipping unpatched stable kernels prior to the fix commits
Discovery Timeline
- 2026-05-06 - CVE-2026-43128 published to NVD
- 2026-05-06 - Last updated in NVD database
Technical Details for CVE-2026-43128
Vulnerability Analysis
The vulnerability is a double-free style reference counting bug in the kernel RDMA umem dmabuf path. The ib_umem_dmabuf_get_pinned_with_dma_device() function pins a dmabuf and then attempts to map its pages via ib_umem_dmabuf_map_pages(). If this mapping call fails, the original code immediately calls dma_buf_unpin() to release the pin.
However, the cleanup logic does not clear the umem_dmabuf->pinned flag after this immediate unpin. The caller then proceeds to invoke ib_umem_release() as part of standard error handling. This in turn calls ib_umem_dmabuf_revoke(), which observes the still-set pinned flag and issues a second dma_buf_unpin() on a buffer that has already been unpinned.
The second unpin operation decrements the dmabuf pin counter beyond its valid range. This can desynchronize internal dmabuf state and break the unmap-unpin unwind ordering, especially when dmabuf_map_pages fails due to dma_resv_wait_timeout and a non-NULL umem_dmabuf->sgt is present.
Root Cause
The root cause is an incorrect failure-path cleanup that duplicates resource release. The immediate dma_buf_unpin() on map failure overlaps with the unpin performed by the standard ib_umem_release to ib_umem_dmabuf_revoke path. Both paths observe the buffer as eligible for unpinning because the pinned state flag is never cleared between them.
Attack Vector
The vulnerability requires local access to RDMA functionality on a system that supports dmabuf-backed memory regions. Triggering the bug depends on inducing a failure in ib_umem_dmabuf_map_pages(), which can occur under timeout conditions in dma_resv_wait_timeout. No public exploit is available, and the EPSS score is 0.024%, indicating very low expected exploitation activity.
The upstream fix removes the immediate dma_buf_unpin() from the failure path and relies entirely on the ib_umem_release and ib_umem_dmabuf_revoke cleanup chain. This ensures consistent unmap-unpin unwind ordering. See the Kernel Git Commit Fix for details.
Detection Methods for CVE-2026-43128
Indicators of Compromise
- Kernel warnings or WARN_ON traces referencing dma_buf_unpin or ib_umem_dmabuf_revoke
- Reference counter underflow messages from the dmabuf subsystem in dmesg
- Unexpected RDMA application failures or crashes on systems using dmabuf-backed memory regions
Detection Strategies
- Inventory running kernel versions across the fleet and compare against the fixed stable commits referenced in the kernel.org advisories
- Monitor dmesg and /var/log/kern.log for stack traces involving ib_umem_dmabuf_* symbols
- Audit RDMA workloads, particularly GPU-accelerated AI/ML and storage workloads, that exercise dmabuf integration paths
Monitoring Recommendations
- Forward kernel logs to a centralized logging or SIEM platform and alert on dmabuf reference-counting warnings
- Track kernel package versions through configuration management to confirm patch deployment
- Correlate RDMA driver crashes with system stability metrics on hosts running InfiniBand or RoCE workloads
How to Mitigate CVE-2026-43128
Immediate Actions Required
- Apply the upstream kernel patches that remove the redundant dma_buf_unpin() from ib_umem_dmabuf_get_pinned_with_dma_device()
- Update to a stable kernel release that includes the fix commits from the kernel.org stable tree
- Restart affected hosts after kernel updates so RDMA drivers reload with the corrected code
Patch Information
The fix is available in the Linux stable tree across multiple supported branches. Refer to the following commits: Kernel Git Commit Update, Kernel Git Commit Fix, Kernel Git Commit Change, Kernel Git Commit Improvement, Kernel Git Commit Enhancement, and Kernel Git Commit Security Update. Track distribution security advisories for backported builds.
Workarounds
- Restrict access to RDMA device nodes such as /dev/infiniband/* to trusted users only via group permissions
- Disable RDMA dmabuf integration for workloads that do not require GPU or peer-device memory sharing
- Where RDMA is not in use, unload the relevant InfiniBand kernel modules to remove the affected code path from the kernel
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
