CVE-2026-43500 rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
A flaw in the Linux kernel's rxrpc module allows memory corruption when processing packets with shared fragments, potentially enabling code execution or privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-43500?
CVE-2026-43500 is a high-severity memory corruption vulnerability in Linux kernel, published on 11 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec().
Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Which versions are affected by CVE-2026-43500?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-43500?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-43500 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43500 exists.
Public exploit code: 1 Metasploit module, 2 Exploit-DB entries and 2 proofs of concept on GitHub.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-86366, BELL-CVE-2026-43500, DEBIAN-CVE-2026-43500, GHSA-8p2w-g92w-f4x3, UBUNTU-CVE-2026-43500.