Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-43500— rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在缓冲区错误漏洞，该漏洞源于rxrpc中DATA和RESPONSE数据包处理时未对分页片段进行分离，可能导致就地解密路径绑定外部分页片段。

CVSS 7.8 · High EPSS 2.26% · P83

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 12

VendorProduct Version RangeStatus
Linux Linux d0d5c0cd1e711c98703f3544c1e6fc1372898de5< 7c504ffab3efce8f7e4f463b314ae31030bdf18b affected
d0d5c0cd1e711c98703f3544c1e6fc1372898de5< 3711382a77342a9a1c3d2e7330dcfc7ea927f568 affected
d0d5c0cd1e711c98703f3544c1e6fc1372898de5< 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c affected
d0d5c0cd1e711c98703f3544c1e6fc1372898de5< d45179f8795222ce858770dc619abe51f9d24411 affected
d0d5c0cd1e711c98703f3544c1e6fc1372898de5< aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 affected
5.3 affected
< 5.3 unaffected
6.6.140≤ 6.6.* unaffected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-43500

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 缓冲区错误漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在缓冲区错误漏洞，该漏洞源于rxrpc中DATA和RESPONSE数据包处理时未对分页片段进行分离，可能导致就地解密路径绑定外部分页片段。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux d0d5c0cd1e711c98703f3544c1e6fc1372898de5 ~ 7c504ffab3efce8f7e4f463b314ae31030bdf18b -
Linux Linux 5.3 -

II. Public POCs for CVE-2026-43500

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-43500

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-43500 (5)

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-43500

No comments yet

Leave a comment