PT-2026-38907 · Linux+3 · Linux Kernel+3
Hyunwoo Kim
+1
·
Published
2026-04-29
·
Updated
2026-06-07
·
CVE-2026-43500
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
An issue exists in the RxRPC subsystem of the Linux kernel involving the incorrect handling of fragmented packets and data copying mechanisms in socket buffers. Specifically, the DATA-packet handler in
rxrpc input call event() and the RESPONSE handler in rxrpc verify response() only copy the socket buffer (skb) to a linear one when skb cloned() is true. If an skb is not cloned but contains externally-owned paged fragments—such as those set by splice() into a UDP socket via ip append data or a chained skb has frag list()—it enters the in-place decryption path. This process binds the fragment pages directly into the AEAD/skcipher SGL via skb to sgvec(), which can lead to page-cache corruption. This flaw allows an unprivileged local user to write data into the page cache, potentially resulting in a denial of service or local privilege escalation to root level.Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
DoS
LPE
Memory Corruption
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Red Os
Ubuntu