CVEs / CVE-2026-43500
CVE-2026-43500: Linux Linux vulnerability
- high 7.8 CVSS 3.1 (NVD)
- EPSS 94.1% chance of exploitation in the next 30 days, higher than 99% of CVEs (30 Oct 2026)
- Last changed at its sources
Are you affected? Check your servers with Stackurity: it lists the software on each server and the vulnerabilities to fix first.
Check your servers with Stackurity Already using Stackurity? Search for CVE-2026-43500
Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Affected and fixed versions
| Product | Affected | Fixed in |
|---|---|---|
| Linux Linux | from d0d5c0cd1e711c98703f3544c1e6fc1372898de5, before 7c504ffab3efce8f7e4f463b314ae31030bdf18b | 7c504ffab3efce8f7e4f463b314ae31030bdf18b |
| Linux Linux | from d0d5c0cd1e711c98703f3544c1e6fc1372898de5, before 3711382a77342a9a1c3d2e7330dcfc7ea927f568 | 3711382a77342a9a1c3d2e7330dcfc7ea927f568 |
| Linux Linux | from d0d5c0cd1e711c98703f3544c1e6fc1372898de5, before 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c | 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c |
| Linux Linux | from d0d5c0cd1e711c98703f3544c1e6fc1372898de5, before d45179f8795222ce858770dc619abe51f9d24411 | d45179f8795222ce858770dc619abe51f9d24411 |
| Linux Linux | from d0d5c0cd1e711c98703f3544c1e6fc1372898de5, before aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 | aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 |
| Linux Linux | 5.3 | — |
| Product | Affected | Fixed in |
|---|---|---|
| Kernel (Linux) | from 5.3.0, before 6.6.140 | 6.6.140 |
| Kernel (Linux) | from 6.7.0, before 6.12.88 | 6.12.88 |
| Kernel (Linux) | from 6.13.0, before 6.18.29 | 6.18.29 |
| Kernel (Linux) | from 6.19.0, before 7.0.6 | 7.0.6 |
Exploitation
Not in the CISA Known Exploited Vulnerabilities catalog as of 30 Oct 2026.
Severity
| CVSS 3.1 | 7.8 highCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HScored by NVD |
|---|---|
| Weakness | CWE-787, CWE-123 |
References
- CVE-2026-43500 on NVD
- CVE-2026-43500 on OSV
- https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568
- https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Patch
- https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b
- https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Patch
- https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 Patch
- https://access.redhat.com/security/cve/CVE-2026-43500
- https://bugzilla.redhat.com/show_bug.cgi?id=2468273
- https://github.com/V4bel/dirtyfrag
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json
Sources
Exploitation status from the CISA Known Exploited Vulnerabilities catalog. EPSS scores from FIRST. Descriptions, severity and references from the National Vulnerability Database. Open-source package versions from OSV (CC-BY 4.0). Text is shown as each source states it; Stackurity does not edit it. Check the vendor's advisory before acting.
This product uses data from the NVD API but is not endorsed or certified by the NVD.