CVE-2026-43494

In the Linux kernel, the following vulnerability has been resolved:

net/rds: reset op_nents when zerocopy page pin fails

When iovitergetpages2() fails in rdsmessagezcopyfromuser(), the pinned pages are released with putpage(), and rm->data.opmmpznotifier is cleared. But we fail to properly clear rm->data.op_nents.

Later when rdsmessagepurge() is called from rdssendmsg() the cleanup loop iterates over the incorrectly non zero number of opnents and frees them again.

Fix this by properly resetting opnents when it should be in rdsmessagezcopyfrom_user().