8.8
HIGH
CVSS 3.1
CVE-2026-43503
net: skbuff: propagate shared-frag marker through frag-transfer helpers
Overview
Description
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.
Details
INFO
Published Date :
May 23, 2026, 12:17 p.m.
Last Modified :
July 23, 2026, 11:10 a.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Scoring
CVSS Scores
The Common Vulnerability Scoring System is a standardized framework
for assessing the severity of vulnerabilities in software and systems.
We collect and displays CVSS scores from various sources for each CVE.
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | ||||
| CVSS 3.1 | HIGH | 0b0ca135-0b70-47e7-9f44-1890c2a1c46c |
Solution
Propagate shared frag marker during coalescing to maintain data integrity.
- Update the Linux kernel to include the fix.
- Ensure skb_try_coalesce preserves the shared frag marker.
- Verify ESP input checks handle shared frags correctly.
Public PoC/Exploit Available at Github
CVE-2026-43503 has a 39 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43503.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43503 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43503
weaknesses.
CAPEC-21: Exploitation of Trusted Identifiers Exploitation of Trusted Identifiers
CAPEC-60: Reusing Session IDs (aka Session Replay) Reusing Session IDs (aka Session Replay)
CAPEC-61: Session Fixation Session Fixation
CAPEC-62: Cross Site Request Forgery Cross Site Request Forgery
CAPEC-196: Session Credential Falsification through Forging Session Credential Falsification through Forging
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
None
Shell
Updated: 2 days, 18 hours ago
0 stars
0 fork
0 watcher
Born at : July 21, 2026, 8:59 a.m.
This repo has been linked 5 different CVEs too.
linux 重要提权漏洞枚举脚本
Updated: 3 days, 11 hours ago
1 stars
0 fork
0 watcher
Born at : July 21, 2026, 3:43 a.m.
This repo has been linked 19 different CVEs too.
Localroot binary exploit toolkit (xpl2026) - private mirror
Python Shell Dockerfile Makefile C Perl
Updated: 4 days, 2 hours ago
0 stars
0 fork
0 watcher
Born at : July 20, 2026, 9:27 p.m.
This repo has been linked 19 different CVEs too.
Documentação de um laboratório doméstico de cibersegurança, com foco em arquitetura, ferramentas, configurações, testes práticos, monitoramento, análise de segurança e aprendizado contínuo.
Updated: 4 days, 5 hours ago
0 stars
0 fork
0 watcher
Born at : July 20, 2026, 8:09 p.m.
This repo has been linked 1 different CVEs too.
None
Shell Python
Updated: 3 days, 22 hours ago
0 stars
0 fork
0 watcher
Born at : July 19, 2026, 10:38 a.m.
This repo has been linked 4 different CVEs too.
Documentação de laboratório doméstico de cibersegurança, incluindo arquitetura, ferramentas, configurações, testes e aprendizados práticos.
blue-team cybersecurity home-lab linux network-security security-monitoring siem wazuh
Updated: 1 week, 1 day ago
0 stars
0 fork
0 watcher
Born at : July 16, 2026, 8:27 p.m.
This repo has been linked 1 different CVEs too.
None
Updated: 2 weeks, 1 day ago
0 stars
0 fork
0 watcher
Born at : July 9, 2026, 6:05 a.m.
This repo has been linked 1 different CVEs too.
Full Weaponized LPE Toolkit 2026
exploit linux-privilege-escalation privilage-escalation rootkit toolkit
C
Updated: 2 weeks, 3 days ago
1 stars
0 fork
0 watcher
Born at : July 3, 2026, 2:19 p.m.
This repo has been linked 19 different CVEs too.
None
Python
Updated: 3 weeks, 3 days ago
0 stars
0 fork
0 watcher
Born at : June 30, 2026, 12:16 p.m.
This repo has been linked 1 different CVEs too.
None
C
Updated: 3 weeks, 3 days ago
0 stars
0 fork
0 watcher
Born at : June 30, 2026, 7:17 a.m.
This repo has been linked 1 different CVEs too.
Multi-CVE audit for the Linux page-cache LPE family with Prometheus output and behavioural IoC hunt
Shell
Updated: 1 week, 1 day ago
0 stars
0 fork
0 watcher
Born at : June 29, 2026, 11:51 p.m.
This repo has been linked 8 different CVEs too.
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
Python
Updated: 3 weeks, 4 days ago
0 stars
0 fork
0 watcher
Born at : June 29, 2026, 3:34 p.m.
This repo has been linked 1 different CVEs too.
Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption
Python
Updated: 3 weeks, 1 day ago
19 stars
7 fork
7 watcher
Born at : June 29, 2026, 4:44 a.m.
This repo has been linked 1 different CVEs too.
DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503
C
Updated: 3 weeks, 4 days ago
1 stars
1 fork
1 watcher
Born at : June 28, 2026, 3:23 a.m.
This repo has been linked 1 different CVEs too.
Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR.
blue-team bpftrace container-security cve defensive-security ebpf hardening kernel-security linux page-cache privilege-escalation seccomp
Shell
Updated: 3 weeks, 6 days ago
2 stars
0 fork
0 watcher
Born at : June 27, 2026, 2:23 p.m.
This repo has been linked 2 different CVEs too.
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43503 vulnerability anywhere in the article.
-
The Hacker News
Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, whic ... Read more
Published Date:
Jul 24, 2026 (16 hours, 3 minutes ago)
-
security.nl
Tails-gebruikers te ontmaskeren via Linux-lekken DirtyClone en pedit COW
De makers van het op privacy gerichte besturingssysteem hebben een nieuwe versie uitgebracht die twee kwetsbaarheden in de Linux-kernel verhelpt waardoor gebruikers zijn te ontmaskeren. Het gaat om de ... Read more
Published Date:
Jul 01, 2026 (3 weeks, 2 days ago)
-
The Hacker News
New DirtyClone Linux Kernel Flaw Lets Local Users Gain Root via Cloned Packets
DirtyClone is a new Linux kernel privilege escalation in the DirtyFrag family. JFrog Security Research published a working exploit walkthrough for the flaw on June 25, the first public demonstration f ... Read more
Published Date:
Jun 26, 2026 (4 weeks ago)
-
security.nl
Privacy-OS Tails komt wegens ernstig Linux-lek met noodpatch
Het op privacy gerichte besturingssysteem Tails heeft wegens een ernstige kwetsbaarheid in de Linux-kernel een noodpatch uitgebracht. Via het beveiligingslek zou een met Tails meegeleverde applicatie ... Read more
Published Date:
Jun 04, 2026 (1 month, 2 weeks ago)
The following table lists the changes that have been made to the
CVE-2026-43503 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Translated by [email protected]
Jul. 23, 2026
Action Type Old Value New Value Added Translation Title: Linux, Description: En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: net: skbuff: propagar el marcador de fragmento compartido a través de los ayudantes de transferencia de fragmentos Dos ayudantes de transferencia de fragmentos (__pskb_copy_fclone() y skb_shift()) no logran propagar el bit SKBFL_SHARED_FRAG en skb_shinfo()->flags al mover fragmentos del origen al destino. __pskb_copy_fclone() difiere el resto de los metadatos de shinfo a skb_copy_header() después de copiar los descriptores de fragmentos, pero ese ayudante solo transfiere gso_{size,segs,type} y nunca toca skb_shinfo()->flags; skb_shift() mueve los descriptores de fragmentos directamente y deja las banderas intactas. Como resultado, el skb de destino mantiene una referencia a las mismas páginas de propiedad externa o respaldadas por la caché de páginas mientras informa skb_has_shared_frag() como falso. La falta de coincidencia es perjudicial en cualquier escritor in situ que utiliza skb_has_shared_frag() para decidir si las páginas compartidas deben desviarse a través de skb_cow_data(). La entrada ESP es uno de esos escritores (esp4.c, esp6.c), y una única regla nft 'dup to <local>' -- o cualquier otro llamador de nf_dup_ipv4() / xt_TEE -- es suficiente para que un skb copiado con pskb_copy() llegue a esp_input() con el marcador eliminado, permitiendo que un usuario sin privilegios escriba en la caché de páginas de un archivo de solo lectura propiedad de root a través de escrituras errantes de authencesn-ESN. Establecer SKBFL_SHARED_FRAG en el destino siempre que los descriptores de fragmentos se hayan movido realmente del origen. skb_copy() y skb_copy_expand() también comparten skb_copy_header() pero linealizan todos los datos paginados en almacenamiento de cabecera recién asignado y emergen con nr_frags == 0, por lo que skb_has_shared_frag() devuelve falso por sí mismo; no necesitan cambios. La misma omisión existe en skb_gro_receive() y skb_gro_receive_list(). El primero mueve los descriptores de fragmentos del skb entrante al último sub-skb del acumulador a través de dos rutas (un bucle directo de movimiento de fragmentos y la ruta head_frag + memcpy); el segundo encadena el skb entrante completo a la frag_list de p. skb_segment() aguas abajo solo lee skb_shinfo(p)->flags, y skb_segment_list() reutiliza el shinfo de cada sub-skb como el nskb -- tanto p como lp deben llevar el marcador. La misma omisión también existe en tcp_clone_payload(), que construye un skb de sondeo de MTU moviendo descriptores de fragmentos de skbs en sk_write_queue a un nskb recién asignado. El ayudante pertenece a la misma familia y justifica la misma corrección por coherencia; actualmente no se conoce ningún escritor in situ del lado TX de TCP que alcance una página de usuario a través de esta brecha, pero un futuro consumidor que dependa del marcador regresaría silenciosamente. La misma omisión existe en skb_segment(): la fusión de banderas por iteración toma solo la bandera de head_skb, y el switch interno que reasigna frag_skb a list_skb al agotarse los fragmentos de head_skb no incorpora la bandera del nuevo frag_skb en nskb. Incorporar la bandera de frag_skb en ambos sitios para que los segmentos que extraen fragmentos de los miembros de frag_list lleven el marcador. -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 15, 2026
Action Type Old Value New Value Changed Affected [{'cpes': ['cpe:/a:redhat:enterprise_linux_nvidia:10::el10'], 'vendor': 'Red Hat', 'product': 'NVIDIA for RHEL 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.12::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.12', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.13::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.13', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.15::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.15', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.16::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.16', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.18::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.18', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.19::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.19', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.20::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.20', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.21::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.21', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS AUS (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus_long_life:8.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS AUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS TUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.0::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.2::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CRB (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux RT (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:enterprise_linux_nvidia:10::el10'], 'vendor': 'Red Hat', 'product': 'NVIDIA for RHEL 10', 'versions': [{'status': 'unaffected', 'version': '0:6.12.0-211.8.el10nv', 'lessThan': '*', 'versionType': 'rpm'}, {'status': 'unaffected', 'version': '0:6.12.0-231.12.el10nv', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'versions': [{'status': 'unaffected', 'version': '0:6.12.0-211.16.1.el10_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10.0 Extended Update Support', 'versions': [{'status': 'unaffected', 'version': '0:6.12.0-55.75.1.el10_0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-553.125.1.rt7.466.el8_10', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-553.125.1.el8_10', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'packageName': 'kpatch-patch', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.4 Advanced Mission Critical Update Support', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-305.192.1.el8_4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus_long_life:8.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.4 Extended Update Support Long-Life Add-On', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-305.192.1.el8_4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.6 Advanced Mission Critical Update Support', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-372.193.1.el8_6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.6 Telecommunications Update Service', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-372.193.1.el8_6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.6 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-372.193.1.el8_6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.8 Telecommunications Update Service', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-477.143.1.el8_8', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:4.18.0-477.143.1.el8_8', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions', 'packageName': 'kpatch-patch', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9', 'cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-687.10.1.el9_8', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-70.180.1.el9_0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.0 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-70.180.1.rt21.252.el9_0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-284.172.1.el9_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-284.172.1.rt14.457.el9_2', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.2 Update Services for SAP Solutions', 'packageName': 'kpatch-patch', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.4 Extended Update Support', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-427.126.1.el9_4', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.4'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions', 'packageName': 'kpatch-patch', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.6 Extended Update Support', 'versions': [{'status': 'unaffected', 'version': '0:5.14.0-570.116.1.el9_6', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9.6 Extended Update Support', 'packageName': 'kpatch-patch', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4.12::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.12', 'versions': [{'status': 'unaffected', 'version': '412.86.202605271418-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.13::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.13', 'versions': [{'status': 'unaffected', 'version': '413.92.202605271328-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.15::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.15', 'versions': [{'status': 'unaffected', 'version': '415.92.202606030318-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.16::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.16', 'versions': [{'status': 'unaffected', 'version': '416.94.202605200242-0', 'lessThan': '*', 'versionType': 'rpm'}, {'status': 'unaffected', 'version': '416.94.202606051757-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.18::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.18', 'versions': [{'status': 'unaffected', 'version': '418.94.202605260517-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.19::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.19', 'versions': [{'status': 'unaffected', 'version': '4.19.9.6.202606031700-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.20::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.20', 'versions': [{'status': 'unaffected', 'version': '4.20.9.6.202605270908-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.21::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.21', 'versions': [{'status': 'unaffected', 'version': '4.21.9.6.202606030721-0', 'lessThan': '*', 'versionType': 'rpm'}], 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'packageName': 'kernel-rt', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'packageName': 'rhcos', 'collectionURL': 'https://access.redhat.com/downloads/content/package-browser/', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jul. 02, 2026
Action Type Old Value New Value Added Reference https://access.redhat.com/errata/RHSA-2026:19521 Added Reference https://access.redhat.com/errata/RHSA-2026:19540 Added Reference https://access.redhat.com/errata/RHSA-2026:19568 Added Reference https://access.redhat.com/errata/RHSA-2026:19569 Added Reference https://access.redhat.com/errata/RHSA-2026:19664 Added Reference https://access.redhat.com/errata/RHSA-2026:19666 Added Reference https://access.redhat.com/errata/RHSA-2026:19705 Added Reference https://access.redhat.com/errata/RHSA-2026:19711 Added Reference https://access.redhat.com/errata/RHSA-2026:19875 Added Reference https://access.redhat.com/errata/RHSA-2026:20051 Added Reference https://access.redhat.com/errata/RHSA-2026:20054 Added Reference https://access.redhat.com/errata/RHSA-2026:20087 Added Reference https://access.redhat.com/errata/RHSA-2026:20129 Added Reference https://access.redhat.com/errata/RHSA-2026:20130 Added Reference https://access.redhat.com/errata/RHSA-2026:20299 Added Reference https://access.redhat.com/errata/RHSA-2026:20593 Added Reference https://access.redhat.com/errata/RHSA-2026:21656 Added Reference https://access.redhat.com/errata/RHSA-2026:21690 Added Reference https://access.redhat.com/errata/RHSA-2026:21695 Added Reference https://access.redhat.com/errata/RHSA-2026:21702 Added Reference https://access.redhat.com/errata/RHSA-2026:23233 Added Reference https://access.redhat.com/errata/RHSA-2026:23240 Added Reference https://access.redhat.com/errata/RHSA-2026:23245 Added Reference https://access.redhat.com/errata/RHSA-2026:23468 Added Reference https://access.redhat.com/errata/RHSA-2026:23469 Added Reference https://access.redhat.com/errata/RHSA-2026:23470 Added Reference https://access.redhat.com/errata/RHSA-2026:23471 Added Reference https://access.redhat.com/errata/RHSA-2026:24814 Added Reference https://access.redhat.com/errata/RHSA-2026:25044 Added Reference https://access.redhat.com/errata/RHSA-2026:33486 Changed Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}] [{'cpes': ['cpe:/a:redhat:enterprise_linux_nvidia:10::el10'], 'vendor': 'Red Hat', 'product': 'NVIDIA for RHEL 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.12::el8'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.12', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.13::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.13', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.15::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.15', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.16::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.16', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.18::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.18', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.19::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.19', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.20::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.20', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:openshift:4.21::el9'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4.21', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::appstream'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux AppStream (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS AUS (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus_long_life:8.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS EXTENSION (v.8.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_aus:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS AUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS TUS (v.8.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:8.8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_tus:8.8::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS TUS (v.8.8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.0::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.2::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_e4s:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS E4S (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.4::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:rhel_eus:9.6::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9::baseos'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux BaseOS (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CRB (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat CodeReady Linux Builder EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::crb'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux CodeReady Linux Builder (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux NFV E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::nfv'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time for NFV (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux_eus:10.0'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v. 10.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:10.2'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 10)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:8::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux RT (v. 8)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.0::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.0)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_e4s:9.2::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time E4S (v.9.2)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.4::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.4)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:rhel_eus:9.6::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time EUS (v.9.6)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/a:redhat:enterprise_linux:9::realtime'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux Real Time (v. 9)', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}] -
CVE Modified by 0b0ca135-0b70-47e7-9f44-1890c2a1c46c
Jun. 30, 2026
Action Type Old Value New Value Added Affected [{'cpes': ['cpe:/o:redhat:enterprise_linux:10'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 10', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:9'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 9', 'defaultStatus': 'affected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:6'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 6', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:7'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 7', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/o:redhat:enterprise_linux:8'], 'vendor': 'Red Hat', 'product': 'Red Hat Enterprise Linux 8', 'defaultStatus': 'unaffected'}, {'cpes': ['cpe:/a:redhat:openshift:4'], 'vendor': 'Red Hat', 'product': 'Red Hat OpenShift Container Platform 4', 'defaultStatus': 'unaffected'}] Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-664 Added Reference https://access.redhat.com/security/cve/CVE-2026-43503 Added Reference https://bugzilla.redhat.com/show_bug.cgi?id=2480902 Added Reference https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json -
Initial Analysis by [email protected]
Jun. 26, 2026
Action Type Old Value New Value Added CWE NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.208 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.174 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.141 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.91 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.33 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.10 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 3.9 up to (excluding) 5.10.257 Added Reference Type kernel.org: https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d Types: Patch -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Jun. 17, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': 'fbeab9555564a1b98e8582cd106dfe46c4606991', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': '179f1852bdedc300e373e807cc102cd81feff196', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': '12401fcfb01f53ccc63ab0a3246570fe8f3105ee', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': '989214c66884d70716d83dc1d0bf5e16287bf349', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': 'fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': 'ff375cc75f9167168db38e0464a482d5fbc8d81d', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': '9bc9d6d6967a2239aa57af2aa53554eddd640d20', 'versionType': 'git'}, {'status': 'affected', 'version': 'cef401de7be8c4e155c6746bfccf721a4fa5fab9', 'lessThan': '48f6a5356a33dd78e7144ae1faef95ffc990aae0', 'versionType': 'git'}], 'programFiles': ['net/core/gro.c', 'net/core/skbuff.c', 'net/ipv4/tcp_output.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '3.9'}, {'status': 'unaffected', 'version': '0', 'lessThan': '3.9', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.10.257', 'versionType': 'semver', 'lessThanOrEqual': '5.10.*'}, {'status': 'unaffected', 'version': '5.15.208', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.174', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.141', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.91', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.33', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.0.10', 'versionType': 'semver', 'lessThanOrEqual': '7.0.*'}, {'status': 'unaffected', 'version': '7.1', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/core/gro.c', 'net/core/skbuff.c', 'net/ipv4/tcp_output.c'], 'defaultStatus': 'affected'}] -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 30, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 25, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 23, 2026
Action Type Old Value New Value Changed Description In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker. Added Reference https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee Added Reference https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196 Added Reference https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349 Added Reference https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20 Added Reference https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991 Added Reference https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 Added Reference https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d Removed Reference https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c Removed Reference https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 Removed Reference https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 Removed Reference https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a Removed Reference https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e Removed Reference https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 Removed Reference https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 23, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost. That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags. Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors. Added Reference https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c Added Reference https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 Added Reference https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 Added Reference https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a Added Reference https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e Added Reference https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 Added Reference https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
EPSS is a daily estimate of the probability of exploitation activity
being observed over the next 30 days. Following chart shows the EPSS
score history of the vulnerability.