VULNpocalypse

CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags

Advisory generated from the CVE record, CISA, Exploit Observer and VEDAS: what it is, whether it is exploited, who is affected, and how to fix and detect it.

Generated by VEDAS. Scores as of 2026-11-11 15:49 UTC. Rebuilt every few hours from cve-scores, CISA KEV and vedas-signatures. How this works and its limits.

What it is

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

Description quoted from the CVE record (assigned by Linux, published 2026-05-08).

Weakness: CWE-123 Write-what-where Condition; Write-what-where Condition

How it can be exploited

Exploitable with local access with low attack complexity needing low privileges and no user interaction. Impact: confidentiality high, integrity high, availability high. CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CISA assessment (SSVC): CISA assesses that a public proof of concept exists. Automatable: no. Technical impact: total.

Public exploit evidence (Exploit Observer)

Exploit Observer found 1 Metasploit module, 2 Exploit-DB entries, 23 code repositories and 1 research write-up naming this CVE.

Code repositories that name a CVE are often scanners, copies or fakes, and some are malware. Read the code before running anything.

See all 42 references on Exploit Observer

Live scores

EPSS
0.942
very likely to be attacked soon
VEDAS
0.977
strong exploit evidence
On CISA KEV
Not listed
Detection rule
Out of scope (local)

Who is affected

ProductAffectedNot affected
Linuxfrom cac2661c53f3 before a6cb440f274a (git commit)
from cac2661c53f3 before ab8b995323e5 (git commit)
from cac2661c53f3 before fe785bb3a809 (git commit)
from cac2661c53f3 before 5d55c7336f80 (git commit)
from cac2661c53f3 before 8253aab4659c (git commit)
from cac2661c53f3 before 50ed1e787310 (git commit)
from cac2661c53f3 before b54edf1e9a3f (git commit)
from cac2661c53f3 before 71a1d9d985d2 (git commit)
and 2 more ranges		Not stated
Linuxversion 4.110 is not affected (up to 4.11); 5.10.255 is not affected; 5.15.205 is not affected; 5.15.206 is not affected

Version ranges exactly as the CVE record states them. “Before X” means X is the first fixed version.

How to fix it

Vendor guidance:

30 more

How to detect it

This bug needs local access to exploit. VEDAS signatures cover remotely exploitable bugs for now, so there is no network rule or remote check for it. Patch it and watch your endpoint telemetry for unusual local activity.

Advisories on this CVE

References

Vendor advisories and patches

26 more

Exploit code

Technical analysis and advisories

Other references

8 more

Other databases

Where this comes from

This advisory is generated automatically by VEDAS from: CVE.org record, cve-scores (EPSS and VEDAS), Exploit Observer. Text in quotes is reproduced from the source; everything else is a fixed template filled with source fields. Nothing here is written by a language model. Check the vendor advisory before acting, and read how VEDAS and Exploit Observer work, and their limits.

Supporting partners

Feasible SecurityAskealGoTrust