CVE-2026-43284

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds buffer operation exists in the xfrm-ESP and RxRPC subsystems. Unsafe in-place cryptographic processing of shared socket buffer fragments allows a low-privileged local attacker to corrupt page-cache contents of readable files, including sensitive system files, and gain root privileges. The xfrm-ESP variant requires the creation of a network namespace or an unprivileged user, while the RxRPC variant requires the rxrpc module to be available on the target system. The issue occurs because IPv4/IPv6 datagram append paths failed to set the SKBFL SHARED FRAG flag when splicing pages into UDP skbs, causing ESP input to decrypt data in place over fragments not privately owned by the skb.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.