CVE-2026-43128

In the Linux kernel, the following vulnerability has been resolved:

RDMA/umem: Fix double dmabufunpin in failure path

In ibumemdmabufgetpinnedwithdmadevice(), the call to ibumemdmabufmappages() can fail. If this occurs, the dmabuf is immediately unpinned but the umemdmabuf->pinned flag is still set. Then, when ibumemrelease() is called, it calls ibumemdmabufrevoke() which will call dmabuf_unpin() again.

Fix this by removing the immediate unpin upon failure and just let the ibumemrelease/revoke path handle it. This also ensures the proper unmap-unpin unwind ordering if the dmabufmappages call happened to fail due to dmaresvwaittimeout (and therefore has a non-NULL umemdmabuf->sgt).