{"id":"CVE-2026-43500","published":"2026-05-11T06:26:45Z","modified":"2026-09-01T12:05:00Z","title":"rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present","vendor":"Linux","product":"Linux","tier":"core","eol":null,"affectedVersions":[{"vendor":"Linux","product":"Linux","versions":[">= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 7c504ffab3efce8f7e4f463b314ae31030bdf18b",">= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 3711382a77342a9a1c3d2e7330dcfc7ea927f568",">= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c",">= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < d45179f8795222ce858770dc619abe51f9d24411",">= d0d5c0cd1e711c98703f3544c1e6fc1372898de5, < aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71"]},{"vendor":"Linux","product":"Linux","versions":["5.3"]}],"description":{"text":"In the Linux kernel, the following vulnerability has been resolved:\n\nrxrpc: Also unshare DATA/RESPONSE packets when paged frags are present\n\nThe DATA-packet handler in rxrpc_input_call_event() and the RESPONSE\nhandler in rxrpc_verify_response() copy the skb to a linear one before\ncalling into the security ops only when skb_cloned() is true.  An skb\nthat is not cloned but still carries externally-owned paged fragments\n(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via\n__ip_append_data, or a chained skb_has_frag_list()) falls through to\nthe in-place decryption path, which binds the frag pages directly into\nthe AEAD/skcipher SGL via skb_to_sgvec().\n\nExtend the gate to also unshare when skb_has_frag_list() or\nskb_has_shared_frag() is true.  This catches the splice-loopback vector\nand other externally-shared frag sources while preserving the\nzero-copy fast path for skbs whose frags are kernel-private (e.g. NIC\npage_pool RX, GRO).  The OOM/trace handling already in place is reused.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Linux kernel's rxrpc networking component fails to unshare certain received DATA and RESPONSE packets that carry externally-owned paged fragments before decrypting them in place, so the frag pages are bound directly into the crypto scatter-gather list. An attacker with local access and low privileges could potentially exploit this by sending crafted traffic that leverages shared fragments, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T13:44:28Z"},"cvss":{"score":7.8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.94118,"percentile":0.99847,"date":"2026-10-30","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-05-11","exploitedFirstSeen":"2026-05-11","ransomware":false,"evidence":[{"url":"https://securityonline.info/the-cve-watchtower-weekly-threat-intelligence-briefing-may-4-may-10-2026/","date":"2026-05-11"},{"url":"https://securelist.com/vulnerabilities-and-exploits-in-q2-2026/121091/","date":"2026-08-26"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":14,"pulses":[{"name":"Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged","url":"https://otx.alienvault.com/pulse/6a62e8d0067f93c04e1d4c9f","created":"2026-07-24"},{"name":"Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged","url":"https://otx.alienvault.com/pulse/6a6280a6b0f220d5330af106","created":"2026-07-23"},{"name":"Known_Cve | May 20, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0c70e0012db9b5d3f1491b","created":"2026-05-19"},{"name":"Known_Cve | May 19, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0b1fb13f83c21729d9156a","created":"2026-05-18"},{"name":"Known_Cve | May 18, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a09cd588d4c1cca2886f0d1","created":"2026-05-17"},{"name":"Known_Cve | May 17, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a087bdcf5d6f8e5402ce221","created":"2026-05-16"},{"name":"Known_Cve | May 16, 2026","url":"https://otx.alienvault.com/pulse/6a072abcce933e7b68efca94","created":"2026-05-15"},{"name":"ACTUALIZACION | relacionada con productos no explotados de Google","url":"https://otx.alienvault.com/pulse/6a049d4f3f03c697a3ebbc52","created":"2026-05-13"},{"name":"Known_Cve | May 14, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6a0487a01a4a82d9d068e332","created":"2026-05-13"},{"name":"EbeeMay2026 Pt2","url":"https://otx.alienvault.com/pulse/6a047bb5f2b9d59bf3636161","created":"2026-05-13"}],"provenance":"machine"},"cwes":[{"id":"CWE-787","name":"Out-of-bounds Write"},{"id":"CWE-123","name":"Write-what-where Condition"}],"references":[{"url":"https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b","tags":[]},{"url":"https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568","tags":[]},{"url":"https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c","tags":[]},{"url":"https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411","tags":[]},{"url":"https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","tags":[]},{"url":"https://github.com/V4bel/dirtyfrag","tags":["exploit"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-43500","tags":["vdb-entry","x_refsource_REDHAT"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2468273","tags":["issue-tracking","x_refsource_REDHAT"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json","tags":["x_sadp-csaf-vex"]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-29037","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-29037","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[{"id":52585,"url":"https://www.exploit-db.com/exploits/52585","title":"Linux Kernel - Local Privilege Escalation","type":"local","platform":"linux","date":"2026-05-27","verified":false,"provenance":"source"},{"id":52591,"url":"https://www.exploit-db.com/exploits/52591","title":"Linux Kernel -  Local Privilege Escalation","type":"local","platform":"linux","date":"2026-05-29","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":2,"earliest":"2026-05-27"},"pocGithub":{"count":2,"skipped":0,"earliest":"2026-04-30","earliestUrl":"https://github.com/attaattaatta/CVE-2026-43500","repos":[{"name":"attaattaatta/CVE-2026-43500","url":"https://github.com/attaattaatta/CVE-2026-43500","stars":0,"created":"2026-04-30"},{"name":"vorkampfer/dirty_frag_mitigation","url":"https://github.com/vorkampfer/dirty_frag_mitigation","stars":0,"created":"2026-05-09"}]},"metasploit":[{"name":"rxkad Page-Cache Write via CVE-2026-43500","module":"exploit/linux/local/cve_2026_43500_dirty_frag","type":"exploit","disclosureDate":"2026-05-08","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/cve_2026_43500_dirty_frag.rb"}],"first":{"date":"2026-04-30","source":"PoC-in-GitHub","url":"https://github.com/attaattaatta/CVE-2026-43500"},"provenance":"source"},"exploitRefs":["https://github.com/V4bel/dirtyfrag"],"flow":[],"timeline":[{"date":"2026-04-30","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub; later: Metasploit 2026-05-08, Exploit-DB 2026-05-27","url":"https://github.com/attaattaatta/CVE-2026-43500","provenance":"source"},{"date":"2026-05-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2026-43500","provenance":"source"},{"date":"2026-05-11","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://securityonline.info/the-cve-watchtower-weekly-threat-intelligence-briefing-may-4-may-10-2026/","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":73.1,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":5.0,"detail":"added 173 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.97,"detail":"percentile 0.9985"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 2 Exploit-DB entries; 2 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":2.67,"detail":"14 pulses"},{"name":"CVSS severity","points":5.46,"detail":"base score 7.8"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}