Skip to content
Fencer Intel
high 7.8

CVE-2026-43500 in the critical feed json

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

published 5mo ago modified 2mo ago also EUVD-2026-29037

cvss
7.8
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
94.1%
EPSS 94.1% chance of exploitation in 30 days, percentile 99.8%
public exploits
3
Metasploit and Exploit-DB

Summary

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

Patch / fix

  • Linux Linux 6.6.140, 6.12.88, 6.18.29, 7.0.6, 7.1
  • linux Debian 12 6.1.170-3
  • linux Debian 13 6.12.86-1
  • linux Debian 14 7.0.4-1

debian advisories DEBIAN-CVE-2026-43500

  • linux Ubuntu 22.04 LTS 5.15.0-181.191
  • linux Ubuntu 24.04 LTS 6.8.0-124.124
  • linux Ubuntu 25.10 6.17.0-35.35
  • linux Ubuntu 26.04 LTS 7.0.0-22.22
  • linux-aws Ubuntu 22.04 LTS 5.15.0-1109.116
  • linux-aws Ubuntu 24.04 LTS 6.8.0-1057.60
  • linux-aws Ubuntu 25.10 6.17.0-1017.17
  • linux-aws Ubuntu 26.04 LTS 7.0.0-1006.6

ubuntu advisories UBUNTU-CVE-2026-43500

Ubuntu security data © Canonical Ltd., from https://github.com/canonical/ubuntu-security-notices via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

  • kernel-syms Linux Micro Extras 6.2 6.12.0-160000.30.1
  • kernel-obs-build Linux Micro Extras 6.2 6.12.0-160000.30.1

suse advisories SUSE-SU-2026:21594-1

  • kernel-source openSUSE Tumbleweed 7.0.7-1.1

opensuse advisories openSUSE-SU-2026:10793-1

  • kernel AlmaLinux 10 6.12.0-211.40.1.el10_2
  • rv AlmaLinux 10 6.12.0-211.40.1.el10_2
  • perf AlmaLinux 10 6.12.0-211.40.1.el10_2
  • rtla AlmaLinux 10 6.12.0-211.40.1.el10_2
  • libperf AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-rt AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-64k AlmaLinux 10 6.12.0-211.40.1.el10_2
  • kernel-core AlmaLinux 10 6.12.0-211.40.1.el10_2

almalinux advisories ALSA-2026:47017

  • kernel Azure Linux 3.0 6.6.141.1-1

azure linux advisories AZL-86366

Azure Linux vulnerability data, Copyright (c) Microsoft Corporation, from https://github.com/microsoft/AzureLinuxVulnerabilityData via OSV, under the MIT licence; changed: normalised to fixed package versions per release. MIT

Is CVE-2026-43500 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-43500 updated cvss 7.8

kernel: "Dirty Frag" RxRPC variant is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel

  • Red Hat Enterprise Linux 6 perf, kernel, python-perf, kernel-kdump, kernel-firmware, kernel-bootwrapper, +1 more Red Hat Enterprise Linux 7 perf, kernel, bpftool, kernel-rt, python-perf, kernel-kdump, +8 more Red Hat Enterprise Linux 8 perf, kernel, bpftool, kernel-rt, kernel-core, kernel-tools, +29 more Red Hat Enterprise Linux 9 rv, perf, rtla, kernel, bpftool, libperf, +83 more Red Hat Enterprise Linux 10 kernel, libkrun Red Hat OpenShift Container Platform 4 openshift/ose-rhel-coreos-8, openshift/ose-rhel-coreos-9
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

cisa ICSA-26-225-04 updated cvss 7.8

Hitachi Energy APM Edge Product

  • Hitachi Energy APM Edge vers:APM_Edge/<=6.10
    affected: mitigation

Facts from CISA's republication of the vendor's own advisory (CSAF); the linked advisory is the authoritative source. CISA notification · csaf

Timeline

  1. First public exploit (Metasploit exploit/linux/local/cve_2026_43500_dirty_frag)
  2. Published

CISA SSVC

Exploitation
none
Automatable
no
Technical impact
total
Assessed
5mo ago

Exploit prediction

94.12% chance of exploitation in the next 30 days, higher than 99.8% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
CNA 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CISA ADP 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 7.8 CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected products

  • Linux Linux
  • Red Hat Red Hat Enterprise Linux 10
  • Red Hat Red Hat Enterprise Linux 6
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat OpenShift Container Platform 4

Classification

Weakness
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: NVD not up to date with latest backported fixes.