CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
INFO
Published Date :
May 11, 2026, 8:16 a.m.
Last Modified :
May 17, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] | ||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
Solution
- Apply the latest Linux kernel security patches.
- Update the Linux kernel to the newest release.
- Verify the integrity of the applied updates.
Public PoC/Exploit Available at Github
CVE-2026-43500 has a 82 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43500.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43500 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43500
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Python
Linux page-cache injector for cross-container escape. Multiple kernel write primitives
Makefile C Shell Assembly
None
Lab detection exercise for DirtyFrag (CVE-2026-43284) - Linux kernel privilege escalation via xfrm-ESP page cache corruption. Full write-up covering exploit execution, detection gaps, and corrected EQL rules using Elastic Stack
None
C
Reproducible isolated lab for verifying Inner Warden's detection of public Linux kernel CVEs. Clone, follow the per-CVE recipe, watch the autonomous agent react on your own VM.
Shell
CachyOS Based Hardened Linux kernel with Rust FFI security hooks - blocks page-cache write vulnerabilities by calling Rust from C at the syscall boundary. Also we add extra optional patches.
Makefile Rust Shell C
None
Патч-скрипты для устранения критических уязвимостей (Copy Fail, Dirty Frag) в РЕД ОС 7.3 и 8.0
Shell
A Go implementation of dirtydecrypt (CVE-2026-31635)
Go
无交互式的 dirtyfrag
C
None
A Go implementation of fragnesia (CVE-2026-46300)
Go
A Go implementation of dirtyfrag (CVE-2026-43284 / CVE-2026-43500)
Go
None
C
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43500 vulnerability anywhere in the article.
-
CybersecurityNews
GitHub Enterprise Server 3.20.3 Released With Fox for Critical Vulnerabilities
GitHub has shipped GitHub Enterprise Server (GHES) 3.20.3 as a security‑driven patch release that fixes multiple critical and high‑severity vulnerabilities and rotates the signing key used to validate ... Read more
-
CybersecurityNews
Multiple cPanel Vulnerabilities Allows Access to Sensitive System Resources
In a severe blow to web hosting environments worldwide, administrators are racing against the clock to patch a massive wave of security vulnerabilities affecting cPanel and WebHost Manager (WHM). Thre ... Read more
-
Ars Technica
Linux bitten by second severe vulnerability in as many weeks
Both privilege escalation vulnerabilities stem from bugs in the kernel’s handling of page caches stored in memory, allowing untrusted users to modify them. They target caches in networking and memory- ... Read more
-
security.nl
Veel QNAP NAS-systemen kwetsbaar voor Linux Dirty Frag-lek
Veel NAS-systemen van fabrikant QNAP zijn kwetsbaar voor het Linux Dirty Frag-lek. Een beveiligingsupdate is echter nog niet beschikbaar. Dirty Frag combineert twee verschillende kernel-kwetsbaarheden ... Read more
The following table lists the changes that have been made to the
CVE-2026-43500 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 17, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added Reference https://github.com/V4bel/dirtyfrag -
Initial Analysis by [email protected]
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-787 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 5.3 up to (excluding) 6.18.29 *cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.6 Added Reference Type kernel.org: https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 Types: Patch -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused. Added Reference https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Added Reference https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Added Reference https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411