CVE-2026-43494

CVE-2026-43494, also known as "PinTheft," is a vulnerability found in the Linux kernel's Reliable Datagram Sockets (RDS) networking code. The core issue stems from an accounting error within the RDS zerocopy mechanism, where the `op_nents` counter is not properly reset when a page pin operation fails during `rds_message_zcopy_from_user()`. This oversight can lead to a double-free or a reference-counting anomaly within the kernel's memory management. This vulnerability becomes particularly impactful when chained with `io_uring` fixed buffers. The exploitation involves repeatedly draining page references through the RDS zerocopy failure path. This manipulation can cause `io_uring` to retain a pointer to a page that has already been freed and potentially reallocated, allowing an attacker to overwrite the in-memory page cache of a SUID-root program and achieve local privilege escalation.