{"answers":{"affected":"It affects 1 product.","exploited":"It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43503 exists.","fix":"Apply the vendor's patch.","what":"CVE-2026-43503 is a high-severity vulnerability in Linux kernel, published on 23 May 2026. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2026-43503 and fix it if it is affected.\n\nWhat it is: CVE-2026-43503 is a high-severity vulnerability in Linux kernel, published on 23 May 2026. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-43503 exists.\n\nAffected product: Linux kernel. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-43503/ (Markdown: https://insights.sbomify.com/CVE-2026-43503/index.md)","id":"CVE-2026-43503","markdown":"https://insights.sbomify.com/CVE-2026-43503/index.md","name":"CVE-2026-43503","record":{"aliases":["AZL-87348","BELL-CVE-2026-43503","DEBIAN-CVE-2026-43503","GHSA-494p-q444-9xf7","ROOT-OS-DEBIAN-11-CVE-2026-43503","ROOT-OS-DEBIAN-12-CVE-2026-43503","UBUNTU-CVE-2026-43503"],"analysis":{"component_type":"kernel","fix_type":"patch","impacts":["privilege_escalation","data_modify"],"network_reachable":"adjacent_or_local","non_default_config":true,"product_category":"Linux kernel","requires_auth":"low_privilege","summary":"An unprivileged user can escalate privileges by writing to root-owned files via a kernel bug in network packet handling when specific firewall rules are active.","user_interaction":"not_required","vuln_class":"privilege_escalation"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"Linux","cpe":[{"product":"linux_kernel","vendor":"linux"}],"cvss":{"score":8.8,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"cwes":[{"id":"CWE-664","name":"Improper Control of a Resource Through its Lifetime"},{"id":"CWE-691","name":"Insufficient Control Flow Management"}],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: skbuff: propagate shared-frag marker through frag-transfer helpers\n\nTwo frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail\nto propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()-\u003eflags when\nmoving frags from source to destination.  __pskb_copy_fclone() defers\nthe rest of the shinfo metadata to skb_copy_header() after copying\nfrag descriptors, but that helper only carries over gso_{size,segs,\ntype} and never touches skb_shinfo()-\u003eflags; skb_shift() moves frag\ndescriptors directly and leaves flags untouched.  As a result, the\ndestination skb keeps a reference to the same externally-owned or\npage-cache-backed pages while reporting skb_has_shared_frag() as\nfalse.\n\nThe mismatch is harmful in any in-place writer that uses\nskb_has_shared_frag() to decide whether shared pages must be detoured\nthrough skb_cow_data().  ESP input is one such writer (esp4.c,\nesp6.c), and a single nft 'dup to \u003clocal\u003e' rule -- or any other\nnf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d\nskb in esp_input() with the marker stripped, letting an unprivileged\nuser write into the page cache of a root-owned read-only file via\nauthencesn-ESN stray writes.\n\nSet SKBFL_SHARED_FRAG on the destination whenever frag descriptors\nwere actually moved from the source.  skb_copy() and skb_copy_expand()\nshare skb_copy_header() too but linearize all paged data into freshly\nallocated head storage and emerge with nr_frags == 0, so\nskb_has_shared_frag() returns false on its own; they need no change.\n\nThe same omission exists in skb_gro_receive() and skb_gro_receive_list().\nThe former moves the incoming skb's frag descriptors into the\naccumulator's last sub-skb via two paths (a direct frag-move loop and\nthe head_frag + memcpy path); the latter chains the incoming skb whole\nonto p's frag_list.  Downstream skb_segment() reads only\nskb_shinfo(p)-\u003eflags, and skb_segment_list() reuses each sub-skb's\nshinfo as the nskb -- both p and lp must carry the marker.\n\nThe same omission also exists in tcp_clone_payload(), which builds an\nMTU probe skb by moving frag descriptors from skbs on sk_write_queue\ninto a freshly allocated nskb.  The helper falls into the same family\nand warrants the same fix for consistency; no TCP TX-side in-place\nwriter is currently known to reach a user page through this gap, but\na future consumer depending on the marker would regress silently.\n\nThe same omission exists in skb_segment(): the per-iteration flag\nmerge takes only head_skb's flag, and the inner switch that rebinds\nfrag_skb to list_skb on head_skb-frags exhaustion does not fold the\nnew frag_skb's flag into nskb.  Fold frag_skb's flag at both sites\nso segments drawing frags from frag_list members carry the marker.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":"2026-05-21","github_poc":8,"max_poc_stars":38,"metasploit":1,"nuclei":0,"refs":[{"date":"2026-06-25T21:58:41Z","kind":"github_poc","ref":"https://github.com/0xredash/CVE-2026-43503","stars":38,"title":"CVE-2026-43503"},{"date":"2026-06-29T04:44:28Z","kind":"github_poc","ref":"https://github.com/entra1337/DirtyClone","stars":27,"title":"Python Proof of Concept for DirtyClone (CVE-2026-43503) - Linux kernel LPE via page-cache corruption"},{"date":"2026-06-26T00:20:58Z","kind":"github_poc","ref":"https://github.com/mooder1/dirtyclone-CVE-2026-43503","stars":17,"title":null},{"date":"2026-06-27T14:23:15Z","kind":"github_poc","ref":"https://github.com/douglasmun/pagecache-lpe-containment-kit","stars":3,"title":"Educational, defensive kit for two Linux page-cache-corruption LPEs (DirtyClone CVE-2026-43503, pedit COW CVE-2026-46331): hardening, detection, verification, seccomp + validation harness. Detection and prevention only — no exploit code. TLP:CLEAR."},{"date":"2026-06-28T03:23:00Z","kind":"github_poc","ref":"https://github.com/gl1tch0x1/DirtyClone","stars":3,"title":"DirtyClone - local privilege escalation (LPE) proof-of-concept targeting a kernel/XFRM-related vulnerability described in the source as CVE-2026-43503"},{"date":"2026-07-09T06:05:34Z","kind":"github_poc","ref":"https://github.com/lieehrdiansyah12/CVE-2026-43503","stars":1,"title":null},{"date":"2026-05-21","kind":"metasploit","ref":"exploit/linux/local/dirtyclone_cve_2026_43503","stars":null,"title":"Linux Kernel DirtyClone Local Privilege Escalation"},{"date":"2026-06-26T21:01:39Z","kind":"github_poc","ref":"https://github.com/sec0x/CVE-2026-43503","stars":0,"title":null}],"tier":"weaponised"},"has_fix":true,"headline":"net: skbuff: propagate shared-frag marker through frag-transfer helpers","id":"CVE-2026-43503","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":"linux:linux_kernel","products":["linux:linux_kernel"],"type":"privilege_escalation","year":"2026"},"n_packages":0,"n_references":8,"next":{"headline":"Missing authorization in Prosody","id":"CVE-2026-43504"},"packages":[],"prev":{"headline":"net/rds: handle zerocopy send cleanup before the message is queued","id":"CVE-2026-43502"},"products":["Linux"],"published":"2026-05-23","related":[{"cvss_score":8.8,"headline":"Linux Kernel Out-of-Bounds Write","id":"CVE-2026-53266","kev_date_added":"2026-09-18","published":"2026-06-25"},{"cvss_score":8.8,"headline":"Linux Kernel Improper Input Validation","id":"CVE-2013-6282","kev_date_added":"2022-09-15","published":"2013-11-19"},{"cvss_score":8.4,"headline":"Linux Kernel Heap-Based Buffer Overflow","id":"CVE-2022-0185","kev_date_added":"2024-08-21","published":"2022-02-11"},{"cvss_score":8.4,"headline":"Linux Kernel Privilege Escalation","id":"CVE-2013-2094","kev_date_added":"2022-09-15","published":"2013-05-14"},{"cvss_score":7.8,"headline":"Linux Kernel Unspecified","id":"CVE-2026-53362","kev_date_added":"2026-08-27","published":"2026-07-04"},{"cvss_score":7.8,"headline":"Linux Kernel Missing Initialization of a Variable","id":"CVE-2026-46300","kev_date_added":"2026-10-28","published":"2026-05-23"},{"cvss_score":7.8,"headline":"Linux Kernel Race Condition","id":"CVE-2025-39964","kev_date_added":"2026-09-18","published":"2025-10-13"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"},{"class":"attribution","licence":"BSD-3-Clause","name":"Metasploit"},{"class":"open","licence":"CC0","name":"PoC-in-GitHub"}],"ssvc":{"automatable":"no","exploitation":"none","technical_impact":"total"},"state":"PUBLISHED","updated":"2026-10-16","vendors":["Linux"]},"summary":"An unprivileged user can escalate privileges by writing to root-owned files via a kernel bug in network packet handling when specific firewall rules are active.","url":"https://insights.sbomify.com/CVE-2026-43503/"}