CVE-2026-43500 | rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Exp

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

Published: 2026-05-11 Last update: 2026-06-17 Assigner: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 Source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
NVD Status：Modified，CVE State: published
View at NVD, CVE.org, EUVD

CVE-2026-43500 is rated High Exploit Risk (80.7/100): CVSS High severity, with high exploitation likelihood (EPSS 92.64%, 100th percentile). 2 public exploit reference(s) are indexed (Exploit-DB). Public exploits are available—assess exposure, apply mitigations, and prioritize patching.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Public exploit references (Exploit-DB) for CVE-2026-43500

EDB-ID Source Kind Published Link
52591 exploit_db edb 2026-05-29 Exploit-DB ↗
52585 exploit_db edb 2026-05-27 Exploit-DB ↗

Exploit prediction scoring system (EPSS) score for CVE-2026-43500

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

# Date Old EPSS score New EPSS score Delta (New - Old)
1 2026-06-23 93.06% 92.64% -0.42%
2 2026-06-19 93.99% 93.06% -0.94%
3 2026-06-15 — 93.99% —

Full EPSS history (12 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2026-43500

CVSS metrics for this CVE.

Base score Version Severity Vector Exploitability Impact Score source
7.8 3.1 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 5.9 416baaa9-dc9f-4396-8d5f-8c081fb06d67
7.8 3.1 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 5.9 [email protected]
7.8 3.1 HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Click to expand
Attack vector (AV:L)
They already need access on the box, or another person has to do something wrong; it’s not a remote drive-by.
Attack complexity (AC:L)
Once they can reach the bug, pulling it off is straightforward—no weird race conditions or rare setup.
Privileges required (PR:L)
A normal user session is enough; they don’t have to be admin.
User interaction (UI:N)
Nobody has to click “OK” or open a trap file; it can work without a victim helping.
Scope (S:U)
Damage stays in the same “trust bubble” as the broken component—no big spill into unrelated systems.
Confidentiality (C:H)
Serious risk that confidential data gets exposed in a big way.
Integrity (I:H)
They could widely tamper with or forge data—trust in the data is badly hurt.
Availability (A:H)
Could take the service down hard or make it unusable for people who depend on it.
 1.8 5.9 134c704f-9b21-4f2e-91b3-4a467353bcc0

Weakness enumeration for CVE-2026-43500

GitHub Security Advisory for CVE-2026-43500

GHSA-8p2w-g92w-f4x3 · Severity: high — In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA...

OS Trackers for CVE-2026-43500

vendor priority summary link
debian not yet assigned CVE-2026-43500 not yet assigned priority: Debian including 2 source packages (linux, linux-6.1), 6 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 6. https://security-tracker.debian.org/tracker/CVE-2026-43500
redhat high — https://access.redhat.com/security/cve/CVE-2026-43500
suse high CVE-2026-43500 severity important: SUSE including 119 source package names (bpftool-4.18.0-553.123.1.el8_10.1, cluster-md-kmp-default, …), 268 product×package rows across 38 product lines (SUSE Liberty Linux 8, SUSE Liberty Linux 9, … (38 product lines)): Known Not Affected 152, Fixed 82, First Fixed 34. https://www.suse.com/security/cve/CVE-2026-43500/
ubuntu high CVE-2026-43500 high priority: Ubuntu including 158 source packages (linux, linux-allwinner-5.19, …), 1422 status rows across 9 suites (bionic, focal, jammy, noble, questing, resolute, trusty, upstream, xenial): DNE 1024, released 176, ignored 169, not-affected 24, pending 18, needed 11. https://ubuntu.com/security/CVE-2026-43500

Affected software / configurations for CVE-2026-43500

Vendor Product Version Raw CPE
linux linux_kernel > 5.3, < 6.18.29 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel >= 6.19, < 7.0.6 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
linux linux_kernel 5.3 cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
linux linux_kernel 5.3 cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:*
linux linux_kernel 5.3 cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*
linux linux_kernel 7.1 cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
linux linux_kernel 7.1 cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*

References for CVE-2026-43500

cvelogic Threat Intelligence