CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
INFO
Published Date :
May 11, 2026, 8:16 a.m.
Last Modified :
June 30, 2026, 3:19 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | |||||
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
- Apply the latest Linux kernel security patches.
- Update the Linux kernel to the newest release.
- Verify the integrity of the applied updates.
Public PoC/Exploit Available at Github
CVE-2026-43500 has a 115 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43500.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43500 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43500
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
IOCs and a read-only triage checklist from a real Linux root compromise: RedTail miner, XorDDoS persistence, MoneroOcean miner, DirtyFrag LPE (CVE-2026-43284/43500). CC0.
Shell
None
C Python
CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit
Python Shell Perl C
Multi-CVE audit for the Linux page-cache LPE family with Prometheus output and behavioural IoC hunt
Shell
Kernel page cache corruption POCs. Educational/research use only.
C
Local Linux CLI collector for Dirty Frag evidence and package inventory
Makefile C Python
Kernel-level Linux rootkit · 4.17–6.x · x86_64 · ftrace hooks (24) · Google C2 · Zero non-Google traffic · Self-rebuilds on kernel upgrade · Evades chkrootkit, rkhunter, and unhide
bypass chkrootkit linux rkhunter rkhunter-antirootkit rootkit c2 calendar gdrive google backdoor clamav lyris malware unhide apt apt41
Go-based Scanner for several 2025-2026 Linux root kernel vulnerabilities (DirtyFrag, Fragnesia, Copy Fail, Fragnesia, DirtyPipe, DirtyClone, pedit COW))
appsec detection-engineering kernel-vulnerability linux security vulnerability-scanner
Makefile Go
DEU univ. 2026 spring semester report
C Shell PHP
Script to check if system are vulnable to cve-2026-23111
Shell
None
CMake Makefile C
Add go CVE-2026-43284 / CVE-2026-43500 (dirtyfrag) local privilege escalation exploit
Go
Personal fork of Joshua-Riek/ubuntu-rockchip image builder for Orange Pi 5B
arm64 orangepi orangepi5b rk3588 rockchip ubuntu securitypatches
Shell Makefile
None
Go
None
Python
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43500 vulnerability anywhere in the article.
-
The Hacker News
16-Year-Old Linux KVM Flaw Lets Guest VMs Escape to Host on Intel and AMD x86 Systems
A use-after-free bug in Linux's KVM hypervisor can be triggered from a guest virtual machine to corrupt the shadow-page state of the host kernel that runs it. Dubbed 'Januscape' and tracked as CVE-202 ... Read more
-
The Hacker News
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration f ... Read more
-
The Hacker News
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, gene ... Read more
-
CybersecurityNews
GitHub Enterprise Server 3.20.3 Released With Fox for Critical Vulnerabilities
GitHub has shipped GitHub Enterprise Server (GHES) 3.20.3 as a security‑driven patch release that fixes multiple critical and high‑severity vulnerabilities and rotates the signing key used to validate ... Read more
-
CybersecurityNews
Multiple cPanel Vulnerabilities Allows Access to Sensitive System Resources
In a severe blow to web hosting environments worldwide, administrators are racing against the clock to patch a massive wave of security vulnerabilities affecting cPanel and WebHost Manager (WHM). Thre ... Read more
-
Ars Technica
Linux bitten by second severe vulnerability in as many weeks
Both privilege escalation vulnerabilities stem from bugs in the kernel’s handling of page caches stored in memory, allowing untrusted users to modify them. They target caches in networking and memory- ... Read more
-
security.nl
Veel QNAP NAS-systemen kwetsbaar voor Linux Dirty Frag-lek
Veel NAS-systemen van fabrikant QNAP zijn kwetsbaar voor het Linux Dirty Frag-lek. Een beveiligingsupdate is echter nog niet beschikbaar. Dirty Frag combineert twee verschillende kernel-kwetsbaarheden ... Read more
The following table lists the changes that have been made to the
CVE-2026-43500 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-123 Added Reference https://access.redhat.com/security/cve/CVE-2026-43500 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2468273 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'd0d5c0cd1e711c98703f3544c1e6fc1372898de5', 'lessThan': '7c504ffab3efce8f7e4f463b314ae31030bdf18b', 'versionType': 'git'}, {'status': 'affected', 'version': 'd0d5c0cd1e711c98703f3544c1e6fc1372898de5', 'lessThan': '3711382a77342a9a1c3d2e7330dcfc7ea927f568', 'versionType': 'git'}, {'status': 'affected', 'version': 'd0d5c0cd1e711c98703f3544c1e6fc1372898de5', 'lessThan': '3eae0f4f9f7206a4801efa5e0235c25bbd5a412c', 'versionType': 'git'}, {'status': 'affected', 'version': 'd0d5c0cd1e711c98703f3544c1e6fc1372898de5', 'lessThan': 'd45179f8795222ce858770dc619abe51f9d24411', 'versionType': 'git'}, {'status': 'affected', 'version': 'd0d5c0cd1e711c98703f3544c1e6fc1372898de5', 'lessThan': 'aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71', 'versionType': 'git'}], 'programFiles': ['net/rxrpc/call_event.c', 'net/rxrpc/conn_event.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.3'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.3', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '6.6.140', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.88', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.29', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.6', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/rxrpc/call_event.c', 'net/rxrpc/conn_event.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
Jun. 17, 2026
Action Type Old Value New Value Added SSVC {'id': 'CVE-2026-43500', 'role': 'CISA Coordinator', 'options': [{'exploitation': 'none'}, {'automatable': 'no'}, {'technicalImpact': 'total'}], 'version': '2.0.3', 'timestamp': '2026-05-11T15:51:19.227001Z'} -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 14, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 17, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added Reference https://github.com/V4bel/dirtyfrag -
Initial Analysis by [email protected]
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 5.3 up to (excluding) 6.18.29 *cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.6 Added Reference Type kernel.org: https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused. Added Reference https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Added Reference https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Added Reference https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411