AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-123

https://access.redhat.com/security/cve/CVE-2026-43500

https://bugzilla.redhat.com/show_bug.cgi?id=2468273

https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.json

[{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 10","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:10"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 6","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:6"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 7","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:7"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 8","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:8"]},{"vendor":"Red Hat","product":"Red Hat Enterprise Linux 9","defaultStatus":"unaffected","cpes":["cpe:/o:redhat:enterprise_linux:9"]},{"vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","defaultStatus":"unaffected","cpes":["cpe:/a:redhat:openshift:4"]}]

{"timestamp":"2026-05-11T15:51:19.227001Z","id":"CVE-2026-43500","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"total"}],"role":"CISA Coordinator","version":"2.0.3"}

[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","programFiles":["net/rxrpc/call_event.c","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"d0d5c0cd1e711c98703f3544c1e6fc1372898de5","lessThan":"7c504ffab3efce8f7e4f463b314ae31030bdf18b","versionType":"git","status":"affected"},{"version":"d0d5c0cd1e711c98703f3544c1e6fc1372898de5","lessThan":"3711382a77342a9a1c3d2e7330dcfc7ea927f568","versionType":"git","status":"affected"},{"version":"d0d5c0cd1e711c98703f3544c1e6fc1372898de5","lessThan":"3eae0f4f9f7206a4801efa5e0235c25bbd5a412c","versionType":"git","status":"affected"},{"version":"d0d5c0cd1e711c98703f3544c1e6fc1372898de5","lessThan":"d45179f8795222ce858770dc619abe51f9d24411","versionType":"git","status":"affected"},{"version":"d0d5c0cd1e711c98703f3544c1e6fc1372898de5","lessThan":"aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71","versionType":"git","status":"affected"}]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","programFiles":["net/rxrpc/call_event.c","net/rxrpc/conn_event.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","versions":[{"version":"5.3","status":"affected"},{"version":"0","lessThan":"5.3","versionType":"semver","status":"unaffected"},{"version":"6.6.140","lessThanOrEqual":"6.6.*","versionType":"semver","status":"unaffected"},{"version":"6.12.88","lessThanOrEqual":"6.12.*","versionType":"semver","status":"unaffected"},{"version":"6.18.29","lessThanOrEqual":"6.18.*","versionType":"semver","status":"unaffected"},{"version":"7.0.6","lessThanOrEqual":"7.0.*","versionType":"semver","status":"unaffected"},{"version":"7.1","lessThanOrEqual":"*","versionType":"original_commit_for_fix","status":"unaffected"}]}]

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

https://git.kernel.org/stable/c/7c504ffab3efce8f7e4f463b314ae31030bdf18b

https://git.kernel.org/stable/c/3711382a77342a9a1c3d2e7330dcfc7ea927f568

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787

https://github.com/V4bel/dirtyfrag

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWE-787

OR
          *cpe:2.3:o:linux:linux_kernel:5.3:-:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:5.3:rc8:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 5.3 up to (excluding) 6.18.29
          *cpe:2.3:o:linux:linux_kernel:5.3:rc7:*:*:*:*:*:*
          *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.19 up to (excluding) 7.0.6

kernel.org: https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Types: Patch

kernel.org: https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Types: Patch

kernel.org: https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 Types: Patch

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true.  This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO).  The OOM/trace handling already in place is reused.

https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c

https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411