CVE-2026-43500: Linux kernel rxrpc out-of-bounds write via shared paged fragments

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityLocal low-privilege out-of-bounds write in the Linux kernel with high EPSS and a public proof-of-concept repository, though not in KEV and requiring local access.

What it is

The rxrpc DATA and RESPONSE handlers only linearize an skb before security operations when skb_cloned() is true, so skbs carrying externally-owned paged fragments (SKBFL_SHARED_FRAG from splice() into a UDP socket, or a chained skb_has_frag_list()) reach the in-place decryption path and bind those frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). The fix extends the unshare gate to also trigger on skb_has_frag_list() or skb_has_shared_frag(). This is a memory-corruption flaw in a core kernel subsystem, and the record lists CWE-787 out-of-bounds write and CWE-123.

Impact

An attacker gains out-of-bounds write capability in kernel memory, which per the CVSS vector (C:H/I:H/A:H) can lead to disclosure, modification and denial of service, and typically to privilege escalation or kernel code execution.

Attack surface

The vector is local (AV:L) with low privileges required (PR:L) and no user interaction (UI:N), reached by sending crafted rxrpc DATA or RESPONSE traffic whose skb frags are externally shared, for example via a splice() loopback into a UDP socket. No remote or unauthenticated path is described in the record.

Exploitation

Not listed in CISA KEV and no ransomware associations are recorded, but EPSS is 0.92855 (99.8th percentile), indicating a high modeled likelihood of exploitation; the references include a public GitHub repository (V4bel/dirtyfrag) alongside the kernel patch links.

What to do

• Apply the upstream stable kernel patches referenced in the record (git.kernel.org commits tagged Patch) to the running kernel and reboot.
• Track vendor advisories (Red Hat CVE page and Bugzilla 2468273) for fixed kernel package versions and update accordingly.
• Restrict local access and untrusted code execution on hosts that expose rxrpc/AFS functionality, since the vector requires local low-privileged access.
• Where rxrpc is not needed, disable or blacklist the rxrpc module to remove the attack surface.
• Monitor for and limit use of splice() into UDP sockets by unprivileged processes on sensitive hosts.

Detection

• Monitor kernel logs for OOM, trace or rxrpc-related warnings that the patch notes say are reused in the affected code path.
• Hunt for unprivileged processes using splice() into UDP sockets, especially in combination with rxrpc/AFS traffic.
• Watch for kernel memory corruption indicators such as unexpected crashes, panics or KASAN reports on hosts running rxrpc.
• Audit kernel versions against the patched stable commits to identify unpatched systems.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.