CVE-2026-43128

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dma_buf_unpin in failure path

In ib_umem_dmabuf_get_pinned_with_dma_device(), the call to

ib_umem_dmabuf_map_pages() can fail. If this occurs, the dmabuf

is immediately unpinned but the umem_dmabuf->pinned flag is still

set. Then, when ib_umem_release() is called, it calls

ib_umem_dmabuf_revoke() which will call dma_buf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let

the ib_umem_release/revoke path handle it. This also ensures the

proper unmap-unpin unwind ordering if the dmabuf_map_pages call

happened to fail due to dma_resv_wait_timeout (and therefore has

a non-NULL umem_dmabuf->sgt).