In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
| Vendor | Product | Versions |
|---|---|---|
| linux | linux_kernel | d0d5c0cd1e711c98703f3544c1e6fc1372898de5, d0d5c0cd1e711c98703f3544c1e6fc1372898de5, d0d5c0cd1e711c98703f3544c1e6fc1372898de5, d0d5c0cd1e711c98703f3544c1e6fc1372898de5, d0d5c0cd1e711c98703f3544c1e6fc1372898de5, 5.3 |
Downstream vendors/products affected by this vulnerability
| Vendor | Product | Source | Confidence |
|---|---|---|---|
| linux | linux | mitre_affected | 90% |
Updated CVSS from 7.8 to 7.9, added new CWE IDs CVE-2026-43284 and CVE-2026-43500, and set patchAvailable to null.
Added new CWE IDs related to the 'Dirty Frag' vulnerabilities and included new relevant tags.
Updated description with new exploit details, added affected versions for various distributions, changed severity to HIGH, added new CWE, and updated tags.
Updated description with detailed exploit information, added affected versions, changed severity to HIGH, and included new tags.
Added new CWE-119 related to the vulnerability.
Updated description with detailed technical information, added affected version 4.10, changed severity to CRITICAL, and included new CWE IDs.
Updated description with critical vulnerability details, changed severity to CRITICAL, and added affected versions 6.18.28, 7.0.5, and 7.1-rc2.
Initial creation
