CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
HighCVSS 7.8
EPSS 94.1%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true. An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().
Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true. This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO). The OOM/trace handling already in place is reused.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | >= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 7c504ffab3efce8f7e4f463b314ae31030bdf18b | 7c504ffab3efce8f7e4f463b314ae31030bdf18b |
| Linux kernel | >= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 3711382a77342a9a1c3d2e7330dcfc7ea927f568 | 3711382a77342a9a1c3d2e7330dcfc7ea927f568 |
| Linux kernel | >= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c | 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c |
| Linux kernel | >= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < d45179f8795222ce858770dc619abe51f9d24411 | d45179f8795222ce858770dc619abe51f9d24411 |
| Linux kernel | >= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 | aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 |
| Linux kernel | = 5.3 | No fix listed |
| Linux kernel | < 6.6.140 | 6.6.140 |
| Linux kernel | < 6.12.88 | 6.12.88 |
| Linux kernel | < 6.18.29 | 6.18.29 |
| Linux kernel | < 7.0.6 | 7.0.6 |
| Linux kernel | < 7.1 | 7.1 |
| redhat enterprise linux | = 10 | No fix listed |
| redhat enterprise linux | = 6 | No fix listed |
| redhat enterprise linux | = 7 | No fix listed |
| redhat enterprise linux | = 8 | No fix listed |
| redhat enterprise linux | = 9 | No fix listed |
| redhat openshift | = 4 | No fix listed |
| ubuntu/linux(Ubuntu:22.04) | < 5.15.0-181.191 | 5.15.0-181.191 |
| ubuntu/linux-kvm(Ubuntu:22.04) | < 5.15.0-1101.106 | 5.15.0-1101.106 |
| ubuntu/linux-raspi(Ubuntu:22.04) | < 5.15.0-1103.106 | 5.15.0-1103.106 |
| ubuntu/linux(Ubuntu:26.04) | < 7.0.0-22.22 | 7.0.0-22.22 |
| ubuntu/linux-raspi(Ubuntu:26.04) | < 7.0.0-1011.11 | 7.0.0-1011.11 |
| Linux kernel | >= 5.3, < 6.18.29 | 6.18.29 |
| Linux kernel | >= 6.19, < 7.0.6 | 7.0.6 |
| Linux kernel | = 5.3-rc7 | No fix listed |
Show 175 more
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux kernel | = 5.3-rc8 | No fix listed |
| Linux kernel | = 7.1-rc1 | No fix listed |
| Linux kernel | = 7.1-rc2 | No fix listed |
| debian/linux(Debian:12) | < 6.1.170-3 | 6.1.170-3 |
| debian/linux(Debian:12) | = 6.1.106-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.106-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.112-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.115-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.119-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.123-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.124-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.128-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.129-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.133-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.135-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.137-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.139-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.140-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.147-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.148-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.153-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.158-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.159-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.162-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.164-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.170-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.27-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.37-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-2~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-3 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4 | No fix listed |
| debian/linux(Debian:12) | = 6.1.38-4~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.52-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.55-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.64-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.66-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.67-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.69-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.76-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.82-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.85-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.90-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.94-1~bpo11+1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.98-1 | No fix listed |
| debian/linux(Debian:12) | = 6.1.99-1 | No fix listed |
| debian/linux(Debian:13) | < 6.12.86-1 | 6.12.86-1 |
| debian/linux(Debian:13) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:13) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:13) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | < 7.0.4-1 | 7.0.4-1 |
| debian/linux(Debian:14) | = 6.12.100-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.101-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.105-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.107-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.111-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.113-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.115-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.115-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.116-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.38-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.41-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.43-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.48-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.57-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.63-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.69-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.73-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.74-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.85-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.86-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.88-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2 | No fix listed |
| debian/linux(Debian:14) | = 6.12.90-2~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.94-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.95-1~bpo12+1 | No fix listed |
| debian/linux(Debian:14) | = 6.12.96-1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.10-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.11-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.8-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13.9-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.13~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.14.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.3-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.4-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15.6-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.15~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.12-2 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.3-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.5-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.16~rc7-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.11-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.13-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.2-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.5-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.6-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.7-2 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.8-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.17.9-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.1-1~exp1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.10-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.12-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.13-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.14-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.15-1~bpo13+1 | No fix listed |
| debian/linux(Debian:14) | = 6.18.2-1~exp1 | No fix listed |
References
- Debian Security Tracker CVE-2026-43500 vendor-advisory
- MSRC Security Update Guide vendor-advisory
- git.kernel.org
- git.kernel.org
- git.kernel.org patch
- git.kernel.org patch
- git.kernel.org patch
- github.com exploit
- Red Hat CVE page mitigation vdb-entry vendor-advisory
- RHBZ#2468273 issue-tracking
- security.access.redhat.com
- www.cve.org
- nvd.nist.gov
- lore.kernel.org
- Ubuntu CVE tracker vendor-advisory
- USN-8370-1 vendor-advisory
- USN-8371-1 vendor-advisory
- USN-8373-1 vendor-advisory
- USN-8374-1 vendor-advisory
- USN-8388-1 vendor-advisory
- USN-8389-1 vendor-advisory
- USN-8391-1 vendor-advisory
- USN-8392-1 vendor-advisory
- USN-8393-1 vendor-advisory
- USN-8426-1 vendor-advisory
- USN-8426-2 vendor-advisory
- USN-8440-1 vendor-advisory
- USN-8388-2 vendor-advisory
- USN-8461-1 vendor-advisory
- USN-8462-1 vendor-advisory
- USN-8489-1 vendor-advisory
- USN-8497-1 vendor-advisory
- USN-8499-1 vendor-advisory
- USN-8528-1 vendor-advisory
- USN-8569-1 vendor-advisory
- USN-8616-1 vendor-advisory