Description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
d0d5c0cd1e711c98703f3544c1e6fc1372898de5 to < 7c504ffab3efce8f7e4f463b314ae31030bdf18baffectedd0d5c0cd1e711c98703f3544c1e6fc1372898de5 to < 3711382a77342a9a1c3d2e7330dcfc7ea927f568affectedd0d5c0cd1e711c98703f3544c1e6fc1372898de5 to < 3eae0f4f9f7206a4801efa5e0235c25bbd5a412caffectedd0d5c0cd1e711c98703f3544c1e6fc1372898de5 to < d45179f8795222ce858770dc619abe51f9d24411affectedd0d5c0cd1e711c98703f3544c1e6fc1372898de5 to < aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71affected
Linux Linux
Default version status: affected
5.3affected0 to < 5.3unaffected6.6.140 to ≤ 6.6.*unaffected6.12.88 to ≤ 6.12.*unaffected6.18.29 to ≤ 6.18.*unaffected7.0.6 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b ↗
- https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568 ↗
- https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c ↗
- https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 ↗
- https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 ↗
- https://github.com/V4bel/dirtyfrag ↗
- https://access.redhat.com/security/cve/CVE-2026-43500 ↗
- https://bugzilla.redhat.com/show_bug.cgi?id=2468273 ↗
- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json ↗