CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE
handler in rxrpc_verify_response() copy the skb to a linear one before
calling into the security ops only when skb_cloned() is true.  An skb
that is not cloned but still carries externally-owned paged fragments
(e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via
__ip_append_data, or a chained skb_has_frag_list()) falls through to
the in-place decryption path, which binds the frag pages directly into
the AEAD/skcipher SGL via skb_to_sgvec().

Extend the gate to also unshare when skb_has_frag_list() or
skb_has_shared_frag() is true.  This catches the splice-loopback vector
and other externally-shared frag sources while preserving the
zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC
page_pool RX, GRO).  The OOM/trace handling already in place is reused.

The Linux kernel CVE team has assigned CVE-2026-43500 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 6.18.29 with commit 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c
	Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 7.0.6 with commit d45179f8795222ce858770dc619abe51f9d24411
	Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 7.1-rc3 with commit aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-43500
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/rxrpc/call_event.c
	net/rxrpc/conn_event.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c
	https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411
	https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71