# CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

> CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present. CVSS 7.8 (CVSS 3.1), named in 2 status incident(s).

Canonical: https://rewindex.com/cve/CVE-2026-43500
Last updated: 2026-09-01T12:05:00Z

- Published: 2026-05-11 06:26 UTC · Updated: 2026-09-01 12:05 UTC · Assigner: Linux
- CVSS: 7.8 (CVSS 3.1) · Severity: High · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- EPSS: n/a
- CISA KEV: no

## Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc\_input\_call\_event() and the RESPONSE handler in rxrpc\_verify\_response() copy the skb to a linear one before calling into the security ops only when skb\_cloned() is true.  An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL\_SHARED\_FRAG set by splice() into a UDP socket via \_\_ip\_append\_data, or a chained skb\_has\_frag\_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb\_to\_sgvec(). Extend the gate to also unshare when skb\_has\_frag\_list() or skb\_has\_shared\_frag() is true.  This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page\_pool RX, GRO).  The OOM/trace handling already in place is reused.

## Affected vendors and products

- Linux: Linux
- Red Hat: Red Hat Enterprise Linux 10
- Red Hat: Red Hat Enterprise Linux 6
- Red Hat: Red Hat Enterprise Linux 7
- Red Hat: Red Hat Enterprise Linux 8
- Red Hat: Red Hat Enterprise Linux 9
- Red Hat: Red Hat OpenShift Container Platform 4

## Status incidents that name it

- 2026-05-13 21:02 UTC [Linode (Akamai): \[Fragnesia\] Linux Privilege Escalation Vulnerability](https://rewindex.com/company/linode-akamai/incidents/m3r11p4pq1zv.md) (names this CVE): “…Linux Privilege Escalation Vulnerability We have completed our investigation and response to the "DirtyFrag" (CVE-2026-43500, CVE-2026-43284) and "Fragnesia" (CVE-2026-46300) vulnerabilities. We have published documentation articles with…”
- 2026-05-08 13:40 UTC [Linode (Akamai): \[DirtyFrag\] Linux Privilege Escalation Vulnerability](https://rewindex.com/company/linode-akamai/incidents/wsvxwlyhw1t5.md) (names this CVE): “…Linux Privilege Escalation Vulnerability We have completed our investigation and response to the "DirtyFrag" (CVE-2026-43500, CVE-2026-43284) and "Fragnesia" (CVE-2026-46300) vulnerabilities. We have published documentation articles with…”

## References

- [CVE record on cve.org](https://www.cve.org/CVERecord?id=CVE-2026-43500)
- [NVD entry](https://nvd.nist.gov/vuln/detail/CVE-2026-43500)
- [https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568](https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568)
- [https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c](https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c)
- [https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b](https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b)
- [https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71](https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71)
- [https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411](https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411)

---

_Sources: CVE records from the CVE Program (cve.org). CVE® is a registered trademark of The MITRE Corporation. (https://www.cve.org/) This product uses data from the NVD API but is not endorsed or certified by the NVD. (https://nvd.nist.gov/) Known Exploited Vulnerabilities catalog from CISA. (https://www.cisa.gov/known-exploited-vulnerabilities-catalog) EPSS scores from FIRST (Exploit Prediction Scoring System). (https://www.first.org/epss/)_


---
Canonical: https://rewindex.com/cve/CVE-2026-43500 · Markdown: https://rewindex.com/cve/CVE-2026-43500.md · JSON: https://rewindex.com/api/v1/cves/CVE-2026-43500 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-10-26T02:48:06.417Z