CVE-2026-43500

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A flaw in the RxRPC networking subsystem occurs when a socket buffer carrying a page-cache reference reaches the authentication verification path. The kernel performs in-place decryption directly on the referenced page without isolating the buffer. This happens because the DATA-packet handler in rxrpc input call event() and the RESPONSE handler in rxrpc verify response() only copy the socket buffer to a linear one when skb cloned() is true, failing to account for buffers that are not cloned but contain externally-owned paged fragments. A low-privileged local attacker can exploit this to corrupt page-cache contents of readable files, such as /etc/passwd, potentially obtaining root privileges. This issue may also lead to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.