From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 9703C2D2397 for ; Mon, 11 May 2026 06:26:55 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778480815; cv=none; b=eQC/8OkW1uoLNyv++xbpY1TdYN5GbBhlhN4Hd+RgD6UDY0eN2jmVor0ifSJbe+ITb+SyW1Xw9pWP272/+r/MadtGPLnfOt3A2cV+VRWeiyZ56j3kcNySUEZpNo8IeStyZ5v3vw3rUfZC4GL5RTzYE/YMc/ofbUer9QuQy4INq88= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1778480815; c=relaxed/simple; bh=VPAHm4W8oyNL5B20VOFrsTemd6R5S5kL/OvIIAPpGSk=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=egB/JMuuxZNJJn7ay/27jKhOW+o2h37KF5Tiz1WFXT8RH+SAJSuh5OjNBQUz7voo6q74c6Xjv8tQk5chtZBdKGCfgPcnOjoEQi+aSeK1MOW8lE6ppfeWmgkafeMlpv8v6AOVZj186KvmFeFZ6fv7wL1jviB10Gmyki1kSmNIbeE= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=G9m0EEKH; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="G9m0EEKH" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 0C8A3C2BCB0; Mon, 11 May 2026 06:26:54 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1778480815; bh=VPAHm4W8oyNL5B20VOFrsTemd6R5S5kL/OvIIAPpGSk=; h=From:To:Cc:Subject:Date:Reply-To:From; b=G9m0EEKHAaPeOT25HQe/8kB+dX74kImpLB9a7WUIGt5WlbJp6qWpVQH3uSRneFnmJ Kc1fPXnX/qeqnPj6Ruygn3fIDFy4ro2sOwN3M+CgsnlGXV6GkOIthFXAEqNeR+201G UVqBKrssAB8U3QLwCKkHCY8CTcjHPRdip6QQgO9k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present Date: Mon, 11 May 2026 08:26:50 +0200 Message-ID: <2026051149-CVE-2026-43500-60d6@gregkh> X-Mailer: git-send-email 2.54.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2902; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=bg/dJ2b1YaXObvyiNmR/7q3K8n0aea7GkFpShaYMRBk=; b=owGbwMvMwCRo6H6F97bub03G02pJDFmMZSs3RLEaN1mdinjxU5ufK0inWcp5nvOcgqjIl4ISX M8eOP7qiGVhEGRikBVTZPmyjefo/opDil6Gtqdh5rAygQxh4OIUgIlcPsQwP2XC4XNuSqz3ZRWF 3WX7tXj2dFxvZZgfwhXssu140MvSatbpRbyvv+zoV3cGAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused. The Linux kernel CVE team has assigned CVE-2026-43500 to this issue. Affected and fixed versions =========================== Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 6.18.29 with commit 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 7.0.6 with commit d45179f8795222ce858770dc619abe51f9d24411 Issue introduced in 5.3 with commit d0d5c0cd1e711c98703f3544c1e6fc1372898de5 and fixed in 7.1-rc3 with commit aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-43500 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/rxrpc/call_event.c net/rxrpc/conn_event.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/3eae0f4f9f7206a4801efa5e0235c25bbd5a412c https://git.kernel.org/stable/c/d45179f8795222ce858770dc619abe51f9d24411 https://git.kernel.org/stable/c/aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71