CVE-2026-43503

Aliases:UBUNTU-CVE-2026-43503DEBIAN-CVE-2026-43503
Advisory lineage Upstream: 0 Downstream: 164
Modified
Published: 23 May 2026, 11:44
Last modified:24 Aug 2026, 12:06

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
8.8 HIGH
v3.1 (cve.org)
EPSS Score
0.34% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

23 May 2026, 11:44
Published
Vulnerability first disclosed
24 Aug 2026, 12:06
Last Modified
Vulnerability information updated

Description

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to <local>' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_has_shared_frag() returns false on its own; they need no change. The same omission exists in skb_gro_receive() and skb_gro_receive_list(). The former moves the incoming skb's frag descriptors into the accumulator's last sub-skb via two paths (a direct frag-move loop and the head_frag + memcpy path); the latter chains the incoming skb whole onto p's frag_list. Downstream skb_segment() reads only skb_shinfo(p)->flags, and skb_segment_list() reuses each sub-skb's shinfo as the nskb -- both p and lp must carry the marker. The same omission also exists in tcp_clone_payload(), which builds an MTU probe skb by moving frag descriptors from skbs on sk_write_queue into a freshly allocated nskb. The helper falls into the same family and warrants the same fix for consistency; no TCP TX-side in-place writer is currently known to reach a user page through this gap, but a future consumer depending on the marker would regress silently. The same omission exists in skb_segment(): the per-iteration flag merge takes only head_skb's flag, and the inner switch that rebinds frag_skb to list_skb on head_skb-frags exhaustion does not fold the new frag_skb's flag into nskb. Fold frag_skb's flag at both sites so segments drawing frags from frag_list members carry the marker.

CVSS Metrics

  • v4.0•HIGH•Score: 8.5CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
  • v3.1•HIGH•Score: 8.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS Trends

Current EPSS score: 0.34%• Percentile: 27%

Techniques & Countermeasures

  • CWE-664•Improper Control of a Resource Through its Lifetime

    The product does not maintain or incorrectly maintains control over a resource throughout its lifetime of creation, use, and release.

Affected Systems

  • debian•linux

    < 5.10.257-1 | < 6.1.174-1 | < 6.12.90-1 | < 7.0.9-1

  • debian•linux-6.1

    < 6.1.174-1~deb11u1

  • ubuntu•linux

    all | < 3.13.0-214.265 | < 4.4.0-283.317 | < 4.15.0-253.265 | < 5.4.0-233.253 | < 5.15.0-181.191 | < 6.8.0-124.124 | < 6.17.0-35.35 | < 7.0.0-22.22

  • ubuntu•linux-allwinner-5.19

    all

  • ubuntu•linux-aws

    all | < 4.4.0-1156.162 | < 4.4.0-1194.209 | < 4.15.0-1194.207 | < 5.4.0-1161.172 | < 5.15.0-1109.116 | < 6.8.0-1057.60 | < 6.17.0-1017.17 | < 7.0.0-1006.6

  • ubuntu•linux-aws-5.0

    all

  • ubuntu•linux-aws-5.11

    all

  • ubuntu•linux-aws-5.13

    all

  • ubuntu•linux-aws-5.15

    < 5.15.0-1109.116~20.04.1

  • ubuntu•linux-aws-5.19

    all

  • ubuntu•linux-aws-5.3

    all

  • ubuntu•linux-aws-5.4

    < 5.4.0-1161.172~18.04.1

  • ubuntu•linux-aws-5.8

    all

  • ubuntu•linux-aws-6.14

    all

  • ubuntu•linux-aws-6.17

    < 6.17.0-1017.17~24.04.1

  • ubuntu•linux-aws-6.2

    all

  • ubuntu•linux-aws-6.5

    all

  • ubuntu•linux-aws-6.8

    < 6.8.0-1057.60~22.04.1

  • ubuntu•linux-aws-fips

    < 4.15.0-2132.138 | all | < 5.4.0-1161.172+fips1 | < 5.15.0-1109.116+fips1 | < 6.8.0-1057.60+fips1

  • ubuntu•linux-aws-hwe

    all | < 4.15.0-1194.207~16.04.1

  • ubuntu•linux-azure

    all | < 4.15.0-1205.220~14.04.1 | < 4.15.0-1204.219~16.04.1 | all | < 5.4.0-1166.172 | < 5.15.0-1114.123 | < 6.8.0-1058.64 | < 6.17.0-1017.17 | < 7.0.0-1007.7

  • ubuntu•linux-azure-4.15

    < 4.15.0-1204.219

  • ubuntu•linux-azure-5.11

    all

  • ubuntu•linux-azure-5.13

    all

  • ubuntu•linux-azure-5.15

    < 5.15.0-1114.123~20.04.1

  • ubuntu•linux-azure-5.19

    all

  • ubuntu•linux-azure-5.3

    all

  • ubuntu•linux-azure-5.4

    < 5.4.0-1166.172~18.04.1

  • ubuntu•linux-azure-5.8

    all

  • ubuntu•linux-azure-6.11

    all

  • ubuntu•linux-azure-6.14

    all

  • ubuntu•linux-azure-6.17

    < 6.17.0-1017.17~24.04.1

  • ubuntu•linux-azure-6.2

    all

  • ubuntu•linux-azure-6.5

    all

  • ubuntu•linux-azure-6.8

    < 6.8.0-1059.65~22.04.1

  • ubuntu•linux-azure-edge

    all

  • ubuntu•linux-azure-fde

    all | all | all | all | all

  • ubuntu•linux-azure-fde-5.19

    all

  • ubuntu•linux-azure-fde-6.14

    all

  • ubuntu•linux-azure-fde-6.2

    all

  • ubuntu•linux-azure-fde-6.8

    all

  • ubuntu•linux-azure-fde-7.0

    all

  • ubuntu•linux-azure-fips

    < 4.15.0-2112.118 | all | < 5.4.0-1166.172+fips1 | < 5.15.0-1114.123+fips1 | < 6.8.0-1059.65+fips1

  • ubuntu•linux-azure-nvidia

    all

  • ubuntu•linux-azure-nvidia-6.14

    all

  • ubuntu•linux-bluefield

    all | < 5.4.0-1120.127 | < 5.15.0-1093.95 | < 6.8.0-1023.27

  • ubuntu•linux-fips

    < 4.4.0-1126.133 | all | < 4.15.0-1149.161 | < 5.4.0-1135.145 | < 5.15.0-181.191+fips1 | < 6.8.0-124.124+fips1

  • ubuntu•linux-gcp

    all | < 4.15.0-1187.204~16.04.1 | all | < 5.4.0-1164.173 | < 5.15.0-1109.118 | < 6.8.0-1060.63 | < 6.17.0-1018.19 | < 7.0.0-1005.5

  • ubuntu•linux-gcp-4.15

    < 4.15.0-1187.204

  • ubuntu•linux-gcp-5.11

    all

Showing first 50 affected entries in server-rendered view.

References (81)