Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2026-43500

CVE-2026-43500HIGH

Linux Linux — rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   L   L   L   N  U  H  H  H    7.8   .0226   82.4     —

AFFECTED
  Product  Versions                                    Fixed
  Linux    d0d5c0cd1e711c98703f3544c1e6fc1372898de5 –  —
  Linux    5.3 –                                       6.6.140

TIMELINE
  May 1   Reserved by Linux
  May 11  Published (CNA: Linux)
  Aug 24  EXPLOIT PUBLISHED — CVE-2026-43500 (Linux). Public exploit reference added.
  Sep 1   EXPLOIT PUBLISHED — CVE-2026-43500 (Linux). Public exploit reference added.

CWE-787 · CNA: Linux · CVSS v3.1 · 9 references · NVD status: Modified

Description

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.

Lifecycle

Complete event history — 4 events, chronological
Date	Event	Detail
May 1, 2026	Reserved	Reserved by Linux
May 11, 2026	Published	Published (CNA: Linux)
August 24, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-43500 (Linux). Public exploit reference added.
September 1, 2026	EXPLOIT PUBLISHED	EXPLOIT PUBLISHED — CVE-2026-43500 (Linux). Public exploit reference added.

Affected

Affected products and packages — 2 rows
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Linux	Linux	—	d0d5c0cd1e711c98703f3544c1e6fc1372898de5	—
Linux	Linux	—	5.3	6.6.140

Weaknesses

CWE-787

References (9)

https://access.redhat.com/security/cve/CVE-2026-43500 [vdb-entry, x_refsource_REDHAT]
https://bugzilla.redhat.com/show_bug.cgi?id=2468273 [issue-tracking, x_refsource_REDHAT]
https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568
https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c
https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b
https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411
https://github.com/V4bel/dirtyfrag [exploit]
https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json [x_sadp-csaf-vex]

Authoritative record: CVE-2026-43500 at cve.org

Vendors: linux

Weaknesses: CWE-787

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2026-43500 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.