{"id":"CVE-2026-43500","url":"https://www.cyber-defence.io/tools/cve/CVE-2026-43500","generatedAt":"2026-10-28T03:22:38.003Z","title":"In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the…","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n\nThe DATA-packet handler in rxrpc_input_call_event() and the RESPONSE\nhandler in rxrpc_verify_response() copy the skb to a linear one before\ncalling into the security ops only when skb_cloned() is true.  An skb\nthat is not cloned but still carries externally-owned paged fragments\n(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via\n__ip_append_data, or a chained skb_has_frag_list()) falls through to\nthe in-place decryption path, which binds the frag pages directly into\nthe AEAD/skcipher SGL via skb_to_sgvec().\n\nExtend the gate to also unshare when skb_has_frag_list() or\nskb_has_shared_frag() is true.  This catches the splice-loopback vector\nand other externally-shared frag sources while preserving the\nzero-copy fast path for skbs whose frags are kernel-private (e.g. NIC\npage_pool RX, GRO).  The OOM/trace handling already in place is reused.","published":"2026-05-11T08:16:16.000Z","lastModified":"2026-08-24T13:18:47.000Z","status":"Modified","sourceIdentifier":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","cvss":{"version":"3.1","score":7.8,"severity":"HIGH","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"cwe":["CWE-787","CWE-123"],"affected":["linux/linux kernel"],"epss":{"score":0.94118,"percentile":0.99846,"date":"2026-10-26","history":[{"date":"2026-09-24","score":0.02257,"percentile":0.82207},{"date":"2026-10-25","score":0.94118,"percentile":0.99846}]},"kev":{"listed":false},"exploits":{"count":2,"verified":false,"firstPublished":"2026-05-27","source":"Exploit-DB (https://gitlab.com/exploit-database/exploitdb)","entries":[{"edbId":52591,"kind":"exploit","title":"Linux Kernel -  Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/52591","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/52591.txt","file":"exploits/linux/local/52591.txt","published":"2026-05-29","added":"2026-05-29","updated":"2026-05-29","author":"nu11secur1ty","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2026-46300","CVE-2026-43500","CVE-2026-43284"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null},{"edbId":52585,"kind":"exploit","title":"Linux Kernel - Local Privilege Escalation","url":"https://www.exploit-db.com/exploits/52585","sourceUrl":"https://gitlab.com/exploit-database/exploitdb/-/blob/main/exploits/linux/local/52585.txt","file":"exploits/linux/local/52585.txt","published":"2026-05-27","added":"2026-05-27","updated":"2026-05-27","author":"nu11secur1ty","type":"local","platform":"linux","port":null,"verified":false,"codes":["CVE-2026-43500","CVE-2026-43284"],"tags":null,"aliases":null,"applicationUrl":null,"screenshotUrl":null,"referenceUrl":null}]},"verdict":{"level":"urgent","text":"EPSS puts the probability of exploitation in the next 30 days at 94.1%, higher than 100% of all known CVEs. Patch or mitigate before the next change window."},"changes":[{"kind":"epss","label":"EPSS jump","at":"2026-10-25T00:00:00.000Z","detail":{"to":0.94118,"from":0.02617,"percentile":0.99846},"summary":"EPSS moved from 2.6% to 94.1% probability of exploitation in the next thirty days."},{"kind":"epss","label":"EPSS jump","at":"2026-09-24T00:00:00.000Z","detail":{"to":0.02257,"from":0.92855,"percentile":0.82207},"summary":"EPSS moved from 92.9% to 2.3% probability of exploitation in the next thirty days."}],"references":[{"url":"https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b","source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411","tags":["Patch"],"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://access.redhat.com/security/cve/CVE-2026-43500","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468273","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"},{"url":"https://github.com/V4bel/dirtyfrag","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json","source":"0b0ca135-0b70-47e7-9f44-1890c2a1c46c"}],"sources":{"nvd":"https://nvd.nist.gov/vuln/detail/CVE-2026-43500","epss":"https://www.first.org/epss/","kev":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","exploitdb":"https://www.exploit-db.com/"},"licence":"CC BY 4.0 — link back to the CVE Explorer if you publish the results; upstream data remains subject to its own terms."}