rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present
Patch now. It exploitation observed by VulnCheck and has a working public exploit.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
A flaw in the Linux kernel's rxrpc networking code allows certain network packets with shared memory fragments to bypass security checks, potentially exposing encrypted data to unauthorized access. This happens because the code only copies packets to ensure safe processing when they're marked as cloned, missing cases where data is still shared through other mechanisms.
CVE-2026-43500 exploits a missing guard in rxrpc's DATA and RESPONSE packet handlers that fail to unshare skbs containing shared page fragments (via SKBFL_SHARED_FRAG, frag_list, or splice mechanisms) before in-place decryption via AEAD/skcipher operations. An attacker with local network access can trigger this via UDP socket manipulation, binding externally-owned pages directly to the SGL, potentially compromising cryptographic integrity and confidentiality.