CVE-2026-43500
highpriority · attend · 74EPSS 0.941 · 100 %ileexploit · functionalDEEURUUSEPSS · scored 2026-10-27
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
remediations
Vendor fix, mitigation, or workaround guidance, as published by each source.
No vendor fix yet; a mitigation is available.
- MitigationAPM Edgecisa_csaf_ot
Disable the rxrpc module [2]
cvss
Technical severity, 0–10. One row per scoring source.
base score 0–10 · higher = more severe · hover a vector to decode
ssvc
A stakeholder decision — act, attend, or track — from exploitation and impact.
weaknesses
The CWE weakness classes this flaw belongs to.
exploits (5)
Public proof-of-concept and weaponised exploit code.
- exploit/linux/local/cve_2026_43500_dirty_fragrxkad Page-Cache Write via CVE-2026-43500functional · metasploit
- EDB-52585Linux Kernel - Local Privilege EscalationPoC · exploit_db
- EDB-52591Linux Kernel - Local Privilege EscalationPoC · exploit_db
affected products (50)
Products and version ranges known to be affected.
advisories (4)
Vendor and ecosystem advisories describing this.
- WID-SEC-W-2026-1430Linux Kernel (Dirty Frag): Mehrere Schwachstellen ermöglichen Erlangen von AdministratorrechtenDeutsch2026-05-07csaf · cert_bundDE
Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Administratorrechte zu erlangen.
- WID-SEC-W-2026-2403Linux Kernel: Mehrere Schwachstellen ermöglichen nicht spezifizierten AngriffDeutsch2026-07-19csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen, möglicherweise Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen oder vertrauliche Informationen offenzulegen.
- WID-SEC-W-2026-2437Oracle Communications: Mehrere SchwachstellenDeutsch2026-07-21csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
- ICSA-26-225-04Hitachi Energy APM Edge Product2026-07-28icsa · cisa_csaf_otUS
Hitachi Energy is aware of Dirty Frag vulnerabilities that affect APM Edge product versions listed in this document. Successful exploitation of these vulnerabilities could result in impact on confidentiality, integrity and availability of the product. Please refer to the Recommended Immediate Actions for information about the mitigation/remediation.
also known as (4)
Other names and identifiers for this entity.
sources
Which sources assert this record, and when.
references (17)
External citations — patches, advisories, analysis.
- https://nvd.nist.gov/vuln/detail/CVE-2026-43500cnnvd
- https://www.exploit-db.com/exploits/52585cnnvd
- https://www.kernel.org/Patchcnnvd
- https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568enisa_euvd
- https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412cenisa_euvd
- https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18benisa_euvd
- https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71enisa_euvd
- https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411enisa_euvd
Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.
Free scan