CVE-2026-46053: net: rds: fix MR cleanup on copy error

Q: What access does an attacker need to exploit this issue?

The reported CVSS vector requires local access and low privileges, with no user interaction required. Exploitation involves causing the generated cookie copy back to user space to fail after the transport has taken ownership of the scatter-gather/pages resources.

Q: What is the likely impact if exploitation succeeds?

The issue is rated high severity with high confidentiality, integrity, and availability impacts in the supplied CVSS vector. The faulty error path can duplicate cleanup of resources that are already owned by the transport.

Q: Which systems are identified as affected?

The affected software list includes the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. No unaffected or fixed version numbers are provided in the available data.

Q: Is there a documented workaround if patching cannot happen immediately?

No workaround or configuration mitigation is provided. The available information identifies upstream stable kernel references containing the resolution.

Published May 27, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

net: rds: fix MR cleanup on copy error

rdsrdmamap() hands sg/pages ownership to the transport after getmr() succeeds. If copying the generated cookie back to user space fails after that point, the error path must not free those resources again before dropping the MR reference.

Remove the duplicate unpin/free from the putuser() failure branch so that MR teardown is handled only through the existing final cleanup path.

Affected Software

15 affected componentsFixes available

Linux Linux kernel

Linux Linux kernel>=5.6.1<5.10.258

Linux Linux kernel>=5.11<5.15.209

Linux Linux kernel>=5.16<6.1.175

Linux Linux kernel>=6.2<6.6.140

Linux Linux kernel>=6.7<6.12.86

Linux Linux kernel>=6.13<6.18.27

Linux Linux kernel>=6.19<7.0.4

Linux Linux kernel=5.6

Linux Linux kernel=5.6-rc3

Linux Linux kernel=5.6-rc4

Linux Linux kernel=5.6-rc5

Linux Linux kernel=5.6-rc6

Linux Linux kernel=5.6-rc7

Microsoft azl3 kernel 6.6.139.1-1<6.6.141.1-1

6.6.141.1-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.141.1-1

Event History

May 27, 2026

CVE Published

via MITRE·12:57 PM

Data Sourced

via MITRE·12:57 PM

DescriptionSeverity

Data Sourced

via NVD·02:17 PM

RemedyDescriptionSeverityAffected Software

May 28, 2026

Data Sourced

via Microsoft·08:05 AM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The reported CVSS vector requires local access and low privileges, with no user interaction required. Exploitation involves causing the generated cookie copy back to user space to fail after the transport has taken ownership of the scatter-gather/pages resources.

What is the likely impact if exploitation succeeds?

The issue is rated high severity with high confidentiality, integrity, and availability impacts in the supplied CVSS vector. The faulty error path can duplicate cleanup of resources that are already owned by the transport.

Which systems are identified as affected?

The affected software list includes the Linux kernel and Microsoft azl3 kernel version 6.6.139.1-1. No unaffected or fixed version numbers are provided in the available data.

Is there a documented workaround if patching cannot happen immediately?

No workaround or configuration mitigation is provided. The available information identifies upstream stable kernel references containing the resolution.

CVE-2026-46053: net: rds: fix MR cleanup on copy error

Affected Software

Remediation

Event History

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Which systems are identified as affected?

Is there a documented workaround if patching cannot happen immediately?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the likely impact if exploitation succeeds?

Which systems are identified as affected?

Is there a documented workaround if patching cannot happen immediately?