CVE-2026-43284

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

CVSS v3.1 Score

8.8

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

EPSS — Exploit Prediction

0.0108

Probability of exploitation

0.78%

Percentile rank

EPSS estimates the probability that this vulnerability will be exploited in the wild within the next 30 days. A higher score means more likely to be exploited.

Weakness Type (CWE)

CWE-123 CWE-123

Affected Products

Vendor	Product	Versions
linux	linux_kernel	4.11 — 5.10.255
linux	linux_kernel	5.12 — 5.15.205
linux	linux_kernel	5.16 — 6.1.171
linux	linux_kernel	6.2 — 6.6.138
linux	linux_kernel	6.7 — 6.12.87
linux	linux_kernel	6.13 — 6.18.28
linux	linux_kernel	7.0 — 7.0.5

References

Advisories & Patches

https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03 https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034 https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97 https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9 https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d

Exploits

https://github.com/V4bel/dirtyfrag

Other References

https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7 https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad http://www.openwall.com/lists/oss-security/2026/05/08/7 http://www.openwall.com/lists/oss-security/2026/05/13/6 http://www.openwall.com/lists/oss-security/2026/05/14/2 http://www.openwall.com/lists/oss-security/2026/05/14/4

Frequently Asked Questions

What is CVE-2026-43284? +

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). It has a CVSS v3.1 base score of 8.8 (HIGH).

How severe is CVE-2026-43284? +

CVE-2026-43284 has a CVSS v3.1 score of 8.8 out of 10, rated HIGH. This is a high-severity vulnerability that should be prioritized for patching. The EPSS score is 0.0108, placing it in the 1th percentile for exploitation probability.

What products are affected by CVE-2026-43284? +

CVE-2026-43284 affects products from linux, specifically: linux_kernel. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2026-43284? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2024-42479 10.0

llama.cpp provides LLM inference in C/C++. The unsafe `data` pointer member in the `rpc_tensor` structure can cause arbitrary address writing. …

CVE-2025-62164 8.8

vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory …

CVE-2025-9900 8.8

A flaw was found in Libtiff. This vulnerability is a "write-what-where" condition, triggered when the library processes a specially crafted …

CVE-2024-44067 8.4

The T-Head XuanTie C910 CPU in the TH1520 SoC and the T-Head XuanTie C920 CPU in the SOPHON SG2042 have …

CVE-2024-36877 8.2

Micro-Star International Z-series motherboards (Z590, Z490, and Z790) and B-series motherboards (B760, B560, B660, and B460) with firmware 7D25v14, 7D25v17 …

CVE-2025-22225 8.2

VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary …