net: skbuff: propagate shared-frag marker through frag-transfer helpers
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched. As a result, the destination skb keeps a reference to the same externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. The mismatch is harmful in any in-place writer that uses skb_has_shared_frag() to decide whether shared pages must be detoured through skb_cow_data(). ESP input is one such writer (esp4.c, esp6.c), and a single nft 'dup to ' rule -- or any other nf_dup_ipv4() / xt_TEE caller -- is enough to land a pskb_copy()'d skb in esp_input() with the marker stripped, letting an unprivileged user write into the page cache of a root-owned read-only file via authencesn-ESN stray writes. Set SKBFL_SHARED_FRAG on the destination whenever frag descriptors were actually moved from the source. skb_copy() and skb_copy_expand() share skb_copy_header() too but linearize all paged data into freshly allocated head storage and emerge with nr_frags == 0, so skb_ha
CVE-2026-43503
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-43503
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "fbeab9555564a1b98e8582cd106dfe46c4606991",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "179f1852bdedc300e373e807cc102cd81feff196",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "12401fcfb01f53ccc63ab0a3246570fe8f3105ee",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "989214c66884d70716d83dc1d0bf5e16287bf349",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "ff375cc75f9167168db38e0464a482d5fbc8d81d",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "9bc9d6d6967a2239aa57af2aa53554eddd640d20",
"versionType": "git"
},
{
"status": "affected",
"version": "cef401de7be8c4e155c6746bfccf721a4fa5fab9",
"lessThan": "48f6a5356a33dd78e7144ae1faef95ffc990aae0",
"versionType": "git"
}
],
"programFiles": [
"net/core/gro.c",
"net/core/skbuff.c",
"net/ipv4/tcp_output.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "3.9"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "3.9",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.257",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.208",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.174",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.141",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.91",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.33",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.0.10",
"versionType": "semver",
"lessThanOrEqual": "7.0.*"
},
{
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"net/core/gro.c",
"net/core/skbuff.c",
"net/ipv4/tcp_output.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-43503
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #32938 · Revision 1
- Added to Heist Feed
- Publisher date