CVE-2026-43500

Think of the rxrpc network feature as a fast “mail sorting” system in the Linux kernel. This bug can mishandle certain packet chunks that are shared by other parts of the system, so the kernel may decrypt data using the wrong underlying memory. An attacker who already has a foothold (local, low privileges) could then crash the machine or, in worst cases, potentially do more.

This matters if you use or run the Linux kernel on servers/VMs/container hosts for linux kernel, OpenShift Container Platform, Debian, Astra Linux, Red Hat Enterprise Linux, Astra Linux Common Edition, Red OS, Osnova Onyx, and SberLinux OS Server. The risk is primarily for attackers who can get local access with low privileges. It’s a concern when the vulnerable rxrpc code path is reachable in your environment; the finding does not confirm “internet-reachable by default.”

This is an AMBER issue: while we don’t have evidence of widespread public exploitation, the bug is in the Linux kernel and local low-privilege attackers can potentially exploit it. The issue is actively receiving attention due to available patches, and attackers are likely to target it once they gain local access, so you should patch promptly.

Confirm exposure

• On each affected host, record the running kernel version:
  • uname -r
  • Also check the kernel package version as reported by your OS package manager.
• Determine whether you are running a kernel build that is older than the fixed revisions/versions listed in the Patch section.

Patch / upgrade

• Upgrade the Linux kernel to one of the fixed revisions/versions:
  • 7c504ffab3efce8f7e4f463b314ae31030bdf18b
  • 3711382a77342a9a1c3d2e7330dcfc7ea927f568
  • 3eae0f4f9f7206a4801efa5e0235c25bbd5a412c
  • d45179f8795222ce858770dc619abe51f9d24411
  • aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71
  • 6.18.29
• For OpenShift Container Platform and each listed enterprise distribution: apply the vendor-provided kernel/security update so you get a supported build that includes the fix. (The exact package names vary by vendor release track.)
• After upgrading, reboot hosts if your OS/vendor requires it, and verify uname -r reflects the patched kernel.

Temporary workaround (if patching is delayed)

• No vendor-specific workaround is provided in the findings. The safest mitigation is to reduce the chance of local attacker access (tighten local user privileges, harden SSH/admin access, and limit shell access), since exploitation requires local low-privilege access.

Monitor after patching

• Check for any stability incidents related to networking during rollout (service crashes, kernel panics, or rxrpc-related errors), and ensure they stop after the patched kernel is running.

CISA due date

• Not provided (KEV is not listed in CISA KEV for this CVE).

Severity is rated HIGH (CVSS 7.8). The vulnerability is in the Linux kernel rxrpc subsystem (CWE-787). Mechanism: the rxrpc handlers copy skb to a linear form only when the skb is cloned; however, certain non-cloned skbs can still carry externally-owned/shared page fragments (for example via splice-related paths or fragment lists). In those cases, the code can fall through to an in-place decryption path that binds the shared frag pages directly into the cryptographic scatter/gather representation, which can be abused to trigger denial of service and potentially arbitrary code execution after local low-privilege access. KEV listing: not listed. Public exploit code: none reported in the findings. Exploitation in the wild: no clear dated press claim. Patch maturity: multiple fixed kernel revisions are available, including backported version 6.18.29. EPSS is very high and rising, but public messaging here should not rely on predicted values; the presence of patches and kernel impact make remediation important.