Linux Kernel: rxrpc Decryption Unshare Exposes Shared Frags
CVE-2026-43500 Published on May 11, 2026
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true. An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().
Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true. This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO). The OOM/trace handling already in place is reused.
Vulnerability Analysis
CVE-2026-43500 is exploitable with local system access, and requires small amount of user privileges. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to be very high.
Weakness Type
What is a Memory Corruption Vulnerability?
The software writes data past the end, or before the beginning, of the intended buffer. Typically, this can result in corruption of data, a crash, or code execution. The software may modify an index or perform pointer arithmetic that references a memory location that is outside of the boundaries of the buffer. A subsequent write operation then produces undefined or unexpected results.
CVE-2026-43500 has been classified to as a Memory Corruption vulnerability or weakness.
Products Associated with CVE-2026-43500
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and below 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c is affected.
- Version d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and below d45179f8795222ce858770dc619abe51f9d24411 is affected.
- Version d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and below aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 is affected.
- Version 5.3 is affected.
- Before 5.3 is unaffected.
- Version 6.18.29, <= 6.18.* is unaffected.
- Version 7.0.6, <= 7.0.* is unaffected.
- Version 7.1-rc3, <= * is unaffected.