CVE-2026-43500

Published May 11, 2026

Last updated a month ago

CVSS high 7.8

Ubuntu

hsm

Cloud

Container Security

Tunneling protocol

Server

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-43500 is a vulnerability found within the Linux kernel's RxRPC networking subsystem, forming one half of a pair of flaws collectively dubbed "Dirty Frag." This issue arises when a non-linear socket buffer, which carries a splice-pinned page-cache reference, reaches the RxRPC authentication verification path. Instead of isolating the buffer, the kernel performs an in-place decryption directly on the referenced page-cache page. This behavior can be exploited by an unprivileged local attacker to corrupt the contents of the page-cache. By manipulating cached data in memory, an attacker could potentially overwrite sensitive system files, such as `/etc/passwd`, to achieve unauthorized access or escalate privileges.

Description: In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD status: Modified
Products: linux_kernel

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.8
Impact score: 5.9
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

nvd@nist.gov: CWE-787
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-787
0b0ca135-0b70-47e7-9f44-1890c2a1c46c: CWE-123

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "2F5215BD-689F-49B2-937A-9079FBEBB871",
            "versionEndExcluding": "6.18.29",
            "versionStartExcluding": "5.3",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D1645824-82F2-4C95-994E-29C41C5F08B7",
            "versionEndExcluding": "7.0.6",
            "versionStartIncluding": "6.19",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*",
            "matchCriteriaId": "D036D76E-AC69-4382-B4C1-8EDA1ABB2941",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:*",
            "matchCriteriaId": "21001886-2C34-45F4-9319-60102B357E64",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*",
            "matchCriteriaId": "999345BA-F820-40B9-A711-32CA9265C289",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
            "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
            "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.