Linux Kernel ESP: Prevent In-Place Decrypt on Shared skb Frags
CVE-2026-43284 Published on May 8, 2026

xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

NVD

Vulnerability Analysis

CVE-2026-43284 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. Public availability of a proof of concept (POC) exploit exists for CVE-2026-43284. The potential impact of an exploit of this vulnerability is considered to be very high.

Attack Vector:
LOCAL
Attack Complexity:
LOW
Privileges Required:
LOW
User Interaction:
NONE
Scope:
UNCHANGED
Confidentiality Impact:
HIGH
Integrity Impact:
HIGH
Availability Impact:
HIGH

Weakness Type

Write-what-where Condition

Any condition where the attacker has the ability to write an arbitrary value to an arbitrary location, often as the result of a buffer overflow.


Products Associated with CVE-2026-43284

You can be notified by email with stack.watch whenever vulnerabilities like CVE-2026-43284 are published in these products:

Linux Kernel
 
Amazon Aws
 
Canonical Ubuntu Linux
 
Red Hat Enterprise Linux Nvidia
 
Red Hat Openshift
 
Red Hat Enterprise Linux Eus
 
Red Hat Enterprise Linux (RHEL)
 
Red Hat Rhel E4s
 
Red Hat Rhel Eus
 
Red Hat Rhel Aus
 
Red Hat Rhel Eus Long Life
 
Red Hat Rhel Tus
 

Affected Versions

Linux: Linux: Red Hat NVIDIA for RHEL 10: Red Hat OpenShift Container Platform 4.12: Red Hat OpenShift Container Platform 4.13: Red Hat OpenShift Container Platform 4.14: Red Hat OpenShift Container Platform 4.15: Red Hat OpenShift Container Platform 4.16: Red Hat OpenShift Container Platform 4.17: Red Hat OpenShift Container Platform 4.18: Red Hat OpenShift Container Platform 4.19: Red Hat OpenShift Container Platform 4.20: Red Hat OpenShift Container Platform 4.21: Red Hat Enterprise Linux AppStream EUS (v. 10.0): Red Hat Enterprise Linux AppStream (v. 10): Red Hat Enterprise Linux AppStream E4S (v.9.0): Red Hat Enterprise Linux AppStream E4S (v.9.2): Red Hat Enterprise Linux AppStream EUS (v.9.4): Red Hat Enterprise Linux AppStream EUS (v.9.6): Red Hat Enterprise Linux AppStream (v. 9): Red Hat Enterprise Linux BaseOS EUS (v. 10.0): Red Hat Enterprise Linux BaseOS (v. 10): Red Hat Enterprise Linux BaseOS (v. 8): Red Hat Enterprise Linux BaseOS AUS (v.8.4): Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4): Red Hat Enterprise Linux BaseOS AUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.6): Red Hat Enterprise Linux BaseOS TUS (v.8.6): Red Hat Enterprise Linux BaseOS E4S (v.8.8): Red Hat Enterprise Linux BaseOS TUS (v.8.8): Red Hat Enterprise Linux BaseOS E4S (v.9.0): Red Hat Enterprise Linux BaseOS E4S (v.9.2): Red Hat Enterprise Linux BaseOS EUS (v.9.4): Red Hat Enterprise Linux BaseOS EUS (v.9.6): Red Hat Enterprise Linux BaseOS (v. 9): Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0): Red Hat Enterprise Linux CodeReady Linux Builder (v. 10): Red Hat Enterprise Linux CRB (v. 8): Red Hat CodeReady Linux Builder EUS (v.9.4): Red Hat CodeReady Linux Builder EUS (v.9.6): Red Hat Enterprise Linux CodeReady Linux Builder (v. 9): Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0): Red Hat Enterprise Linux Real Time for NFV (v. 10): Red Hat Enterprise Linux NFV (v. 8): Red Hat Enterprise Linux NFV E4S (v.9.0): Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2): Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4): Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6): Red Hat Enterprise Linux Real Time for NFV (v. 9): Red Hat Enterprise Linux Real Time EUS (v. 10.0): Red Hat Enterprise Linux Real Time (v. 10): Red Hat Enterprise Linux RT (v. 8): Red Hat Enterprise Linux Real Time E4S (v.9.0): Red Hat Enterprise Linux Real Time E4S (v.9.2): Red Hat Enterprise Linux Real Time EUS (v.9.4): Red Hat Enterprise Linux Real Time EUS (v.9.6): Red Hat Enterprise Linux Real Time (v. 9): Red Hat Enterprise Linux 6: Red Hat Enterprise Linux 7:

Exploit Probability

EPSS
92.17%
Percentile
99.81%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.