Answer in brief
CVE-2026-43500 records a High severity (CVSS 7.8) vulnerability in rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 7.8. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=d0d5c0cd1e711c98703f3544c1e6fc1372898de5 <7c504ffab3efce8f7e4f463b314ae31030bdf18b || >=d0d5c0cd1e711c98703f3544c1e6fc1372898de5 <3711382a77342a9a1c3d2e7330dcfc7ea927f568 || >=d0d5c0cd1e711c98703f3544c1e6fc1372898de5 <3eae0f4f9f7206a4801efa5e0235c25bbd5a412c || >=d0d5c0cd1e711c98703f3544c1e6fc1372898de5 <d45179f8795222ce858770dc619abe51f9d24411 || >=d0d5c0cd1e711c98703f3544c1e6fc1372898de5 <aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 | 7c504ffab3efce8f7e4f463b314ae31030bdf18b, 3711382a77342a9a1c3d2e7330dcfc7ea927f568, 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c, d45179f8795222ce858770dc619abe51f9d24411, aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 |
| Linux/Linuxgeneric | 5.3 | Not reported |
Published upstream
May 11, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Sep 1, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Jul 15, 2026
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Quoted source text, attributed separately from HOL analysis.