Skip to content
OpenAdvisories
High · 7.8 Public exploit CVE-2026-43500 EUVD-2026-29037GHSA-8p2w-g92w-f4x3

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

Published May 11, 2026 · Updated Sep 1, 2026 · Assigned by Linux

Vendor: Linux Product: Linux Package: kernel Package: linux Package: linux Package: linux-allwinner-5.19 Package: linux-aws Package: linux-aws-5.0 Package: linux-aws-5.11 Package: linux-aws-5.13 Package: linux-aws-5.15 Package: linux-aws-5.19 Package: linux-aws-5.3 Package: linux-aws-5.4 Package: linux-aws-5.8 Package: linux-aws-6.14 Package: linux-aws-6.17 Package: linux-aws-6.2 Package: linux-aws-6.5 Package: linux-aws-6.8 Package: linux-aws-fips Package: linux-azure Package: linux-azure-5.11 Package: linux-azure-5.13 Package: linux-azure-5.15 Package: linux-azure-5.19 Package: linux-azure-5.3 Package: linux-azure-5.4 Package: linux-azure-5.8 Package: linux-azure-6.11 Package: linux-azure-6.14 Package: linux-azure-6.17 Package: linux-azure-6.2 Package: linux-azure-6.5 Package: linux-azure-6.8 Package: linux-azure-edge Package: linux-azure-fde Package: linux-azure-fde-5.19 Package: linux-azure-fde-6.14 Package: linux-azure-fde-6.2 Package: linux-azure-fde-6.8 Package: linux-azure-fips Package: linux-azure-nvidia Package: linux-azure-nvidia-6.14 Package: linux-bluefield Package: linux-fips Package: linux-gcp Package: linux-gcp-5.11 Package: linux-gcp-5.13 Package: linux-gcp-5.15 Package: linux-gcp-5.19 Package: linux-gcp-5.3 Package: linux-gcp-5.4 Package: linux-gcp-5.8 Package: linux-gcp-6.11 Package: linux-gcp-6.14 Package: linux-gcp-6.17 Package: linux-gcp-6.2 Package: linux-gcp-6.5 Package: linux-gcp-6.8 Package: linux-gcp-fips Package: linux-gke Package: linux-gke-4.15 Package: linux-gke-5.15 Package: linux-gke-5.4 Package: linux-gkeop Package: linux-gkeop-5.15 Package: linux-gkeop-5.4 Package: linux-hwe Package: linux-hwe-5.11 Package: linux-hwe-5.13 Package: linux-hwe-5.15 Package: linux-hwe-5.19 Package: linux-hwe-5.4 Package: linux-hwe-5.8 Package: linux-hwe-6.11 Package: linux-hwe-6.14 Package: linux-hwe-6.17 Package: linux-hwe-6.2 Package: linux-hwe-6.5 Package: linux-hwe-6.8 Package: linux-hwe-7.0 Package: linux-hwe-edge Package: linux-ibm Package: linux-ibm-5.15 Package: linux-ibm-5.4 Package: linux-ibm-6.8 Package: linux-intel-5.13 Package: linux-intel-iot-realtime Package: linux-intel-iotg Package: linux-intel-iotg-5.15 Package: linux-iot Package: linux-kvm Package: linux-lowlatency Package: linux-lowlatency-hwe-5.15 Package: linux-lowlatency-hwe-5.19 Package: linux-lowlatency-hwe-6.11 Package: linux-lowlatency-hwe-6.2 Package: linux-lowlatency-hwe-6.5 Package: linux-lowlatency-hwe-6.8 Package: linux-nvidia Package: linux-nvidia-6.11 Package: linux-nvidia-6.17 Package: linux-nvidia-6.2 Package: linux-nvidia-6.5 Package: linux-nvidia-6.8 Package: linux-nvidia-lowlatency Package: linux-nvidia-tegra Package: linux-nvidia-tegra-5.15 Package: linux-nvidia-tegra-igx Package: linux-oem Package: linux-oem-5.10 Package: linux-oem-5.13 Package: linux-oem-5.14 Package: linux-oem-5.17 Package: linux-oem-5.6 Package: linux-oem-6.0 Package: linux-oem-6.1 Package: linux-oem-6.11 Package: linux-oem-6.14 Package: linux-oem-6.17 Package: linux-oem-6.5 Package: linux-oem-6.8 Package: linux-oem-7.0 Package: linux-oracle Package: linux-oracle-5.0 Package: linux-oracle-5.11 Package: linux-oracle-5.13 Package: linux-oracle-5.15 Package: linux-oracle-5.3 Package: linux-oracle-5.4 Package: linux-oracle-5.8 Package: linux-oracle-6.14 Package: linux-oracle-6.17 Package: linux-oracle-6.5 Package: linux-oracle-6.8 Package: linux-raspi Package: linux-raspi-5.4 Package: linux-raspi-realtime Package: linux-raspi2 Package: linux-realtime Package: linux-realtime-6.14 Package: linux-realtime-6.17 Package: linux-realtime-6.8 Package: linux-riscv Package: linux-riscv-5.11 Package: linux-riscv-5.15 Package: linux-riscv-5.19 Package: linux-riscv-5.8 Package: linux-riscv-6.14 Package: linux-riscv-6.17 Package: linux-riscv-6.5 Package: linux-riscv-6.8 Package: linux-starfive-5.19 Package: linux-starfive-6.2 Package: linux-starfive-6.5 Package: linux-vmware Package: linux-xilinx Package: linux-xilinx-zynqmp Platform: Linux Ecosystem: Azure Linux Ecosystem: Debian Ecosystem: Ubuntu

Description

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true. An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true. This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO). The OOM/trace handling already in place is reused.

Affected products

VendorProductAffectedFixed
Linux Linux 5.3 6.6.140

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

ReleasePackageFixed inAdvisory
Debian 14 linux 7.0.4-1 —
Debian 13 linux 6.12.86-1 —
Debian 12 linux 6.1.170-3 —
ReleasePackageFixed inAdvisory
Ubuntu Nvidia-BlueField 24.04 LTS linux-bluefield 6.8.0-1023.27 —
Ubuntu Nvidia-BlueField 22.04 LTS linux-bluefield 5.15.0-1093.95 —
Ubuntu 26.04 LTS linux 7.0.0-22.22 USN-8370-1
Ubuntu 26.04 LTS linux-aws +1 7.0.0-1006.6 USN-8370-1
Ubuntu 26.04 LTS linux-gcp +1 7.0.0-1005.5 USN-8370-1
Ubuntu 26.04 LTS linux-ibm +1 7.0.0-1007.7 USN-8461-1, USN-8370-1
Ubuntu 26.04 LTS linux-nvidia 7.0.0-1009.9 USN-8370-1
Ubuntu 26.04 LTS linux-oem-7.0 7.0.0-1008.8 USN-8489-1
Ubuntu 26.04 LTS linux-raspi 7.0.0-1011.11 USN-8370-1
Ubuntu 26.04 LTS linux-riscv +1 7.0.0-22.22.1 USN-8370-1
Ubuntu 26.04 LTS linux-vmware No fix yet —
Ubuntu 25.10 linux 6.17.0-35.35 USN-8371-1
Ubuntu 25.10 linux-aws +1 6.17.0-1017.17 USN-8371-1
Ubuntu 25.10 linux-azure-fde No fix yet —
Ubuntu 25.10 linux-gcp 6.17.0-1018.19 USN-8374-1
Ubuntu 25.10 linux-oracle 6.17.0-1016.16 USN-8371-1
Ubuntu 25.10 linux-raspi 6.17.0-1018.18 USN-8371-1
Ubuntu 25.10 linux-realtime 6.17.0-1014.16 USN-8371-1
Ubuntu 25.10 linux-riscv 6.17.0-35.35.1 —
Ubuntu 24.04 LTS linux 6.8.0-124.124 USN-8373-1
Ubuntu 24.04 LTS linux-aws 6.8.0-1057.60 USN-8373-1
Ubuntu 24.04 LTS linux-aws-6.17 +1 6.17.0-1017.17~24.04.1 USN-8374-1, USN-8371-1
Ubuntu 24.04 LTS linux-azure 6.8.0-1058.64 USN-8373-1
Ubuntu 24.04 LTS linux-azure-fde 6.8.0-1058.65 —
Ubuntu 24.04 LTS linux-azure-nvidia 6.8.0-1039.42 —
Ubuntu 24.04 LTS linux-gcp 6.8.0-1060.63 USN-8373-1
Ubuntu 24.04 LTS linux-gcp-6.17 6.17.0-1018.19~24.04.1 USN-8374-1
Ubuntu 24.04 LTS linux-gke 6.8.0-1055.61 USN-8373-1
Ubuntu 24.04 LTS linux-gkeop 6.8.0-1042.45 USN-8373-1
Ubuntu 24.04 LTS linux-hwe-6.17 6.17.0-35.35~24.04.1 USN-8371-1
Ubuntu 24.04 LTS linux-hwe-7.0 7.0.0-28.28~24.04.1 USN-8569-1
Ubuntu 24.04 LTS linux-ibm 6.8.0-1057.58 USN-8373-1
Ubuntu 24.04 LTS linux-lowlatency 6.8.0-134.134.1 USN-8497-1
Ubuntu 24.04 LTS linux-nvidia 6.8.0-1055.58 USN-8373-1
Ubuntu 24.04 LTS linux-nvidia-6.17 6.17.0-1021.21 USN-8371-1
Ubuntu 24.04 LTS linux-nvidia-lowlatency 6.8.0-1055.58.1 USN-8373-1
Ubuntu 24.04 LTS linux-nvidia-tegra 6.8.0-1026.26 USN-8373-1
Ubuntu 24.04 LTS linux-oem-6.17 6.17.0-1024.24 USN-8371-1
Ubuntu 24.04 LTS linux-oracle 6.8.0-1054.55 USN-8373-1
Ubuntu 24.04 LTS linux-oracle-6.17 6.17.0-1016.16~24.04.1 USN-8371-1
Ubuntu 24.04 LTS linux-raspi 6.8.0-1057.61 USN-8373-1
Ubuntu 24.04 LTS linux-riscv +18 No fix yet —
Ubuntu 24.04 LTS linux-riscv-6.17 6.17.0-35.35.1~24.04.1 —
Ubuntu 24.04 LTS linux-xilinx 6.8.0-1032.33 USN-8499-1
Show 13 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu 22.04 LTS linux +1 5.15.0-181.191 USN-8388-1
Ubuntu 22.04 LTS linux-aws 5.15.0-1109.116 USN-8388-1
Ubuntu 22.04 LTS linux-aws-6.8 6.8.0-1057.60~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-azure +1 5.15.0-1114.123 USN-8426-2
Ubuntu 22.04 LTS linux-azure-6.8 6.8.0-1059.65~22.04.1 USN-8440-1
Ubuntu 22.04 LTS linux-azure-fde-6.8 6.8.0-1058.65~22.04.1 —
Ubuntu 22.04 LTS linux-gcp 5.15.0-1109.118 USN-8388-1
Ubuntu 22.04 LTS linux-gcp-6.8 6.8.0-1060.63~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-gke 5.15.0-1105.111 USN-8388-1
Ubuntu 22.04 LTS linux-gkeop 5.15.0-1092.100 USN-8388-1
Ubuntu 22.04 LTS linux-hwe-6.8 +1 6.8.0-124.124~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-ibm +1 5.15.0-1103.106 USN-8388-1
Ubuntu 22.04 LTS linux-ibm-6.8 6.8.0-1057.58~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-intel-iotg 5.15.0-1104.110 USN-8388-1
Ubuntu 22.04 LTS linux-kvm 5.15.0-1101.106 USN-8388-1
Ubuntu 22.04 LTS linux-lowlatency-hwe-6.8 6.8.0-134.134.1~22.04.1 USN-8497-1
Ubuntu 22.04 LTS linux-nvidia 5.15.0-1104.105 USN-8388-1
Ubuntu 22.04 LTS linux-nvidia-6.8 6.8.0-1055.58~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-nvidia-tegra 5.15.0-1061.61 USN-8388-1
Ubuntu 22.04 LTS linux-nvidia-tegra-igx 5.15.0-1050.50 USN-8388-1
Ubuntu 22.04 LTS linux-oracle 5.15.0-1106.112 USN-8388-1
Ubuntu 22.04 LTS linux-oracle-6.8 6.8.0-1054.55~22.04.1 USN-8373-1
Ubuntu 22.04 LTS linux-riscv +32 No fix yet —
Ubuntu 22.04 LTS linux-xilinx-zynqmp 5.15.0-1074.78 USN-8528-1
Ubuntu 20.04 LTS linux-gke +28 No fix yet —
Ubuntu 18.04 LTS linux-gcp +14 No fix yet —
Ubuntu 16.04 LTS linux-hwe-edge No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-raspi-realtime 6.8.0-2046.47 USN-8373-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime 6.8.1-1052.53 USN-8373-1
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.14 No fix yet —
Ubuntu Pro Realtime 24.04 LTS linux-realtime-6.17 6.17.0-1014.16~24.04.1 USN-8371-1
Ubuntu Pro Realtime 22.04 LTS linux-intel-iot-realtime 5.15.0-1101.103 USN-8388-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime 5.15.0-1108.117 USN-8388-1
Ubuntu Pro Realtime 22.04 LTS linux-realtime-6.8 6.8.1-1052.53~22.04.1 USN-8373-1
Ubuntu Pro FIPS 20.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro FIPS-updates 24.04 LTS linux-aws-fips 6.8.0-1057.60+fips1 USN-8373-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-azure-fips 6.8.0-1059.65+fips1 USN-8393-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-fips 6.8.0-124.124+fips1 USN-8373-1
Ubuntu Pro FIPS-updates 24.04 LTS linux-gcp-fips 6.8.0-1060.63+fips1 USN-8373-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-aws-fips 5.15.0-1109.116+fips1 USN-8388-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-azure-fips 5.15.0-1114.123+fips1 USN-8426-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-fips 5.15.0-181.191+fips1 USN-8388-1
Ubuntu Pro FIPS-updates 22.04 LTS linux-gcp-fips 5.15.0-1109.118+fips1 USN-8388-1
Ubuntu Pro FIPS-updates 20.04 LTS linux-aws-fips 5.4.0-1160.170+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-azure-fips 5.4.0-1164.170+fips1 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-fips 5.4.0-1134.144 —
Ubuntu Pro FIPS-updates 20.04 LTS linux-gcp-fips 5.4.0-1163.172+fips1 —
Ubuntu Pro FIPS-preview 22.04 LTS linux-fips +3 No fix yet —
Ubuntu Pro 20.04 LTS linux 5.4.0-231.251 —
Ubuntu Pro 20.04 LTS linux-aws 5.4.0-1160.170 —
Ubuntu Pro 20.04 LTS linux-aws-5.15 5.15.0-1109.116~20.04.1 USN-8388-1
Ubuntu Pro 20.04 LTS linux-azure 5.4.0-1164.170 —
Ubuntu Pro 20.04 LTS linux-azure-5.15 5.15.0-1114.123~20.04.1 USN-8426-1
Ubuntu Pro 20.04 LTS linux-bluefield 5.4.0-1119.126 —
Ubuntu Pro 20.04 LTS linux-gcp 5.4.0-1163.172 —
Ubuntu Pro 20.04 LTS linux-gcp-5.15 5.15.0-1109.118~20.04.1 USN-8388-1
Ubuntu Pro 20.04 LTS linux-hwe-5.15 +1 5.15.0-181.191~20.04.1 USN-8388-1
Ubuntu Pro 20.04 LTS linux-ibm 5.4.0-1107.112 USN-8616-1
Ubuntu Pro 20.04 LTS linux-ibm-5.15 5.15.0-1103.106~20.04.1 USN-8388-1
Ubuntu Pro 20.04 LTS linux-intel-iotg-5.15 5.15.0-1104.110~20.04.1 —
Ubuntu Pro 20.04 LTS linux-iot 5.4.0-1064.67 —
Ubuntu Pro 20.04 LTS linux-kvm 5.4.0-1147.156 —
Ubuntu Pro 20.04 LTS linux-nvidia-tegra-5.15 5.15.0-1061.61~20.04.1 USN-8388-1
Ubuntu Pro 20.04 LTS linux-oracle 5.4.0-1158.168 —
Ubuntu Pro 20.04 LTS linux-oracle-5.15 5.15.0-1106.112~20.04.1 USN-8462-1
Ubuntu Pro 20.04 LTS linux-raspi 5.4.0-1143.156 USN-8391-1
Ubuntu Pro 20.04 LTS linux-riscv-5.15 5.15.0-1103.107~20.04.1 —
Ubuntu Pro 20.04 LTS linux-xilinx-zynqmp 5.4.0-1078.82 —
Ubuntu Pro 18.04 LTS linux-aws-5.4 5.4.0-1160.170~18.04.1 USN-8392-1
Ubuntu Pro 18.04 LTS linux-azure-5.4 5.4.0-1164.170~18.04.1 —
Ubuntu Pro 18.04 LTS linux-gcp-5.4 5.4.0-1163.172~18.04.1 —
Ubuntu Pro 18.04 LTS linux-hwe-5.4 5.4.0-231.251~18.04.1 USN-8392-1
Ubuntu Pro 18.04 LTS linux-ibm-5.4 5.4.0-1107.112~18.04.1 USN-8616-1
Ubuntu Pro 18.04 LTS linux-oracle-5.4 5.4.0-1158.168~18.04.1 —
Ubuntu Pro 18.04 LTS linux-raspi-5.4 5.4.0-1143.156~18.04.1 USN-8391-1

AlmaLinux

Errata ↗
ReleasePackageFixed inAdvisory
AlmaLinux 10 rv +74 6.12.0-211.40.1.el10_2 ALSA-2026:47017
ReleasePackageFixed inAdvisory
SLE Micro 6.2 kernel-syms +1 6.12.0-160000.30.1 SUSE-SU-2026:21594-1
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed kernel-source 7.0.7-1.1 openSUSE-SU-2026:10793-1

Amazon Linux

ReleasePackageFixed inAdvisory
Amazon Linux 2 kernel-livepatch-4.14.355-282.728 1.0-0.amzn2 ALAS2-2026-3302
Amazon Linux 2 perf +8 4.14.355-282.728.amzn2 ALAS2-2026-3302

Azure Linux

ReleasePackageFixed inAdvisory
Azure Linux 3 kernel 6.6.141.1-1 —

Oracle Linux

ReleasePackageFixed inAdvisory
Oracle Linux 9 kernel-uek +34 6.12.0-201.74.2.3.el10uek ELSA-2026-50372, ELSA-2026-50293, ELSA-2026-50260

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

Metasploit 1 module

Exploit-DB 2

GitHub 2 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Advisories 31

References