rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
Linux · Linux
The Linux kernel's rxrpc networking component fails to unshare certain received DATA and RESPONSE packets that carry externally-owned paged fragments before decrypting them in place, so the frag pages are bound directly into the crypto scatter-gather list. An attacker with local access and low privileges could potentially exploit this by sending crafted traffic that leverages shared fragments, with no user interaction required.
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 0
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited the day it was disclosed. Public exploit code (PoC-in-GitHub) was available 11 days before disclosure.
- Public exploit codePoC-in-GitHub11 days before
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.
What security researchers reported
Not named in any threat report yetAlso mentioned in 14 community threat pulses (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.
- Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged24 Jul 2026
- Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged23 Jul 2026
- Known_Cve | May 20, 2026 | Part 1/219 May 2026
- Known_Cve | May 19, 2026 | Part 1/218 May 2026
- Known_Cve | May 18, 2026 | Part 1/217 May 2026
- Known_Cve | May 17, 2026 | Part 1/216 May 2026
- 8 more on OTX