CVE-2026-43502

net/rds: handle zerocopy send cleanup before the message is queued

No known exploitation. EPSS puts it in the 7th percentile. A vendor fix is available.

CVSS 3.17.8High EPSS percentile7th0.2% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixVendor fixNo build named by the sources

Published 2026-05-21Updated 2026-09-15Sources: CVE.org, NVD, BDU

NVD CVE.org

What to do

The vendor has published a fix. Version details are below where the sources state them.

Steps

Written by AI from the record

Check each Linux server’s running kernel version and whether it uses the RDS networking module with zerocopy sends.
Install your distribution’s security update containing Linux kernel 5.10.258 or later.
Restart into the updated kernel and confirm the running version after reboot.
Until updated, restrict untrusted local accounts from systems that use this RDS feature.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

In the Linux kernel, the following vulnerability has been resolved: net/rds: handle zerocopy send cleanup before the message is queued A zerocopy send can fail after user pages have been pinned but before the message is attached to the sending socket. The purge path currently infers zerocopy state from rm->m_rs, so an unqueued message can be cleaned up as if it owned normal payload pages. However, zerocopy ownership is really determined by the presence of op_mmp_znotifier, regardless of whether the message has reached the socket queue. Capture op_mmp_znotifier up front in rds_message_purge() and use it as the cleanup discriminator. If the message is already associated with a socket, keep the existing completion path. Otherwise, drop the pinned page accounting directly and release the notifier before putting the payload pages. This keeps early send failure cleanup consistent with the zerocopy lifetime rules without changing the normal queued completion path.

In plain language

Written by AI from the record

If your servers run an unpatched Linux kernel, a low-privileged local user may be able to drain memory and freeze or crash the system, so prioritize the kernel update.

Local low-privilege denial of service in the Linux kernel RDS module: failed zerocopy sends can leak pinned memory because early cleanup misidentifies the message’s ownership state.

If you're affected

Server memory exhaustion
System crash or freeze
Service interruption
Recovery and restart time

What is it

A flaw can leave pieces of system memory reserved after a failed high-speed network transfer. It is like repeatedly reserving parking spaces for deliveries that never arrive, then never releasing them; eventually there is no room left and the server can stop working.

Who is affected

This matters if you run the Linux kernel on servers or other systems where a local user has limited access. It is relevant when the system uses the RDS networking module and a user can trigger the affected high-speed send operation; it is a local risk, not an internet-reachable one by itself.

How urgent is it

A low-privileged local attacker can repeatedly trigger the flaw to exhaust memory and disrupt the system, which warrants a red-priority response. There is no confirmed real-world exploitation, no CISA known-exploited listing, and no public exploit code, but affected systems should still be updated promptly because disruption does not require administrator access or user interaction.

What to do — in detail

Confirm the running kernel with uname -r, then identify whether the RDS module is present or in use, for example with lsmod | grep '^rds' and your application or service configuration. Prioritize hosts where untrusted or semi-trusted users can run local workloads and RDS zerocopy sends are possible.

Deploy the security kernel supplied by your Linux distribution. The published stable fix is in Linux kernel 5.10.258; upstream also provides backported fixes under commits e9aefdc5c53fe9aed108c14e3d155710a1bb14c9, 46662f7dc59475995609bf3e9d27eb36f4acf26f, 1e262db7675e27f42c3f3f47d6011855f4454f24, 21d70744e6d3bbf9293aa1ee6fba7c53ad75275e, 3abc8983b2bae3f487f77d9da5527d7d6b210d46, 14ef6fd18db2494098b21e0471bf27a1d8e9993e, 0f5c185fc79a59ee9991234dd6d2a3e5afa6e75b, and 44b550d88b267320459d518c0743a241ab2108fa. Use the distribution package rather than manually applying an upstream commit unless you maintain your own kernel.

Plan a reboot, as a running kernel is not corrected merely by installing the package. Kernel updates can require validation of out-of-tree drivers and boot configuration, so test representative systems first if your environment uses those components.

If patching is delayed, disable or avoid the RDS module and zerocopy-send use where operationally feasible, and limit untrusted local accounts on affected hosts. Watch for unexplained, persistent memory depletion, repeated application send failures, kernel memory-pressure events, and unexpected service restarts. KEV provides no remediation deadline because this CVE is not listed there.

Technical context

CVSS v3.1 is 7.8 High (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H). The underlying issue is CWE-401, an improper memory release / memory leak in rds_message_purge() during failed RDS zerocopy-send initialization after user pages are pinned but before the message is queued. An attacker needs local low-privilege access and the ability to trigger that failure path; default reachability is reported as yes.

No confirmed in-the-wild exploitation is reported, CISA KEV does not list the CVE, and no public exploit code is on record. EPSS is 0.1% at the third percentile with a flat trend; this is a prediction, not evidence of exploitation. Exploit maturity is therefore assessed as no public exploit rather than confirmed exploitation. Press attention is rising due to a roundup, not a documented incident.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS7th

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.2% chance of exploitation activity in the next 30 days, which ranks it in the 7th percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

11 events over 117 days, from the signal feeds we watch.

2026-09-15Patch availablerecord updated
2026-09-14Patch availablerecord updated
2026-07-23Patch availablerecord updated
2026-06-26Patch availablerecord updated
2026-06-25OpenVAS check added
2026-05-21Publishedweakness classified

Affected products

Сообщество свободного программного обеспеченияoss-projectaka fsf
- Debian GNU/LinuxOSOn-premOperating Systems / linux-distro
- LinuxOSOn-premOperating Systems / linux-distro
Linuxoss-projectaka the linux kernel
- LinuxOSOn-premOperating Systems / linux-distro
Novell Inc.commercial · US
- openSUSE TumbleweedOn-premOperating Systems / linux-distro

And 1 more affected product. See all after sign-in

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Scored 7.8 by NVD.

How it is reached

Attack Vector LocalRequires local access to the vulnerable system (e.g. local login, malicious file)
Attack Complexity LowNo special conditions — the attack can be reliably reproduced
Privileges Required LowRequires basic user-level privileges
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable

Weaknesses

Sources

References in the record

And 16 more references. See all after sign-in

In the news

⚡ Weekly Recap: Cisco 0-Day, AI Agent RCE, ClickFix Attacks, ClickFix Surge, and Browser HijacksThe Hacker News · 2026-09-21

Watch the software you run.

My Stack ranks new CVEs for your products by real-world exploitation, so the next serious one reaches you without reading every advisory.

We'll flag the next CVE, public exploit or patch for Debian GNU/Linux, not every advisory.

A free account adds

The full version matrix and every affected product
Exploit links, proofs of concept and Metasploit modules
Email alerts for the products you watch
The same data over REST API, MCP and CLI

Create a free account