Summary
It was discovered that the Linux kernel did not properly handle shared page
fragments during socket buffer operations, collectively known as Dirty
Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the
RxRPC networking subsystem when processing paged fragments. A local
attacker could use this to escalate privileges, or possibly escape a
container. (CVE-2026-43284, CVE-2026-43500)
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP
subsystem in the Linux kernel when handling socket buffer fragments. This
flaw is known as Fragnesia. A local attacker could use this to escalate
privileges, or possibly escape a container. (CVE-2026-43503,
CVE-2026-46300)
Qualys discovered that a race condition existed in the ptrace subsystem of
the Linux kernel when privileged processes are exiting. An unprivileged
local attacker could use this issue to expose sensitive information.
(CVE-2026-46333)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- RDS protocol;
(CVE-2026-43494)
Fixed packages 23
| Release | Package | Fixed in |
|---|---|---|
| Ubuntu · 22.04 LTS 22.04:LTS | linux | 5.15.0-181.191 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-aws | 5.15.0-1109.116 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gcp | 5.15.0-1109.118 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gke | 5.15.0-1105.111 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-gkeop | 5.15.0-1092.100 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-ibm | 5.15.0-1103.106 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-intel-iotg | 5.15.0-1104.110 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-kvm | 5.15.0-1101.106 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia | 5.15.0-1104.105 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia-tegra | 5.15.0-1061.61 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-nvidia-tegra-igx | 5.15.0-1050.50 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-oracle | 5.15.0-1106.112 |
| Ubuntu · 22.04 LTS 22.04:LTS | linux-raspi | 5.15.0-1103.106 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-aws-5.15 | 5.15.0-1109.116~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-gcp-5.15 | 5.15.0-1109.118~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-hwe-5.15 | 5.15.0-181.191~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-ibm-5.15 | 5.15.0-1103.106~20.04.1 |
| Ubuntu · Pro 20.04 LTS Pro:20.04:LTS | linux-nvidia-tegra-5.15 | 5.15.0-1061.61~20.04.1 |
| Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS | linux-aws-fips | 5.15.0-1109.116+fips1 |
| Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS | linux-fips | 5.15.0-181.191+fips1 |
| Ubuntu · Pro FIPS-updates 22.04 LTS Pro:FIPS-updates:22.04:LTS | linux-gcp-fips | 5.15.0-1109.118+fips1 |
| Ubuntu · Pro Realtime 22.04 LTS Pro:Realtime:22.04:LTS | linux-intel-iot-realtime | 5.15.0-1101.103 |
| Ubuntu · Pro Realtime 22.04 LTS Pro:Realtime:22.04:LTS | linux-realtime | 5.15.0-1108.117 |
Vulnerabilities 6
-
High 7.8
net: skbuff: preserve shared-frag marker during coalescing
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain t…
KEV Oct 28, 2026 -
High 8.8
xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter()…
-
High 8.8CVE-2026-43503 Public exploit
net: skbuff: propagate shared-frag marker through frag-transfer helpers
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shi…
-
High 7.8CVE-2026-43494 Public exploit
net/rds: reset op_nents when zerocopy page pin fails
In the Linux kernel, the following vulnerability has been resolved: net/rds: reset op_nents when zerocopy page pin fails When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(), the pinned pages are released with put_page(), and rm->data.op_mmp_znot…
-
High 7.8
rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to …
-
High 7.1CVE-2026-46333 Public exploit
ptrace: slightly saner 'get_dumpable()' logic
In the Linux kernel, the following vulnerability has been resolved: ptrace: slightly saner 'get_dumpable()' logic The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and ma…