Skip to main content

Linux Kernel CVE-2026-43503

| EUVDEUVD-2026-31536 HIGH
Improper Control of a Resource Through its Lifetime (CWE-664)
2026-05-23 Linux GHSA-494p-q444-9xf7
Information Disclosure Linux
8.8
CVSS 3.1 · Vendor: Linux
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Local user opens TCP and IPsec endpoints
  2. Delivery
    Trigger sendfile/zero-copy to seed SHARED_FRAG skbs
  3. Exploit
    Induce TCP receive coalescing to merge frags
  4. Execution
    ESP input sees skb_has_shared_frag() as false
  5. Persist
    In-place ESP decryption over page-cache frags
  6. Impact
    Page-cache plaintext leak or corruption across security boundary

Vulnerability Assessment

Weakness
CWE
CWE-664
ASVS 5.0
V15 - Secure Coding and Architecture Resource lifecycle control
Exploitation Conditions

Exploitation requires (1) local access with the ability to open sockets (PR:L per CVSS), (2) the target host actively processing inbound IPsec ESP-protected TCP traffic so the ESP input path executes skb_has_shared_frag() decisions, (3) the presence of an skb carrying SKBFL_SHARED_FRAG paged fragments - typically produced by sendfile(), MSG_ZEROCOPY, or splice from page-cache backed files on the same host - and (4) TCP receive coalescing actually merging that shared-frag skb into an unmarked destination skb at the moment the ESP input runs. Limiting factors: the bug is local-only (AV:L), needs at least an unprivileged account, depends on IPsec ESP being configured and in use on the receiving host (not the default on most servers), and requires a race-like alignment between coalescing and ESP decryption that is non-trivial to engineer reliably. User interaction is not required (UI:N).
Impact

Signals are mixed and warrant careful interpretation. The CVSS 3.1 base score of 8.8 with vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H reflects a local, low-privilege trigger with scope change and full CIA impact - appropriate given that any local user with a network socket and an IPsec-using process can in principle stimulate the coalescing path, and the resulting page-cache corruption crosses a security boundary (Scope: Changed). However, EPSS is only 0.02% (7th percentile), the CVE is not in CISA KEV, and no proof-of-concept is referenced in any source - consistent with the typical profile of a Linux stable-tree fix where exploitation requires both an IPsec ESP receive path and very specific timing of TCP coalescing over zero-copy/sendfile frags. The realistic prerequisites (IPsec ESP in use, attacker-controlled TCP flow that triggers coalescing into a victim's shared-frag skb) make reliable exploitation non-trivial despite the high CVSS. Note also a minor inconsistency: the supplied tags label this as 'Information Disclosure,' yet the CVSS asserts I:H and A:H - the underlying bug supports both info-disclosure (reading decrypted plaintext over page-cache pages) and corruption (writing decrypted bytes back into those pages), so the higher impact rating is defensible.
Exploit ScenarioDerived

A local low-privileged user on a host that terminates IPsec ESP-protected TCP flows opens a socket and arranges traffic patterns that cause TCP receive coalescing to merge a shared-frag (e.g., sendfile- or zero-copy-sourced) skb into an unmarked destination skb consumed by the ESP input path; ESP then decrypts in place over page-cache-backed pages, corrupting file-backed memory or leaking plaintext into another process's mapped file. No public proof-of-concept has been published, and exploitation requires precise control over coalescing timing and an active ESP receive context on the target.
Act Now Prioritize within 24-48h. Why: Active threat signals + CRITICAL/HIGH severity.
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – May 30, 2026

Memory corruption and potential information disclosure in the Linux kernel networking stack (skbuff) occurs because skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG marker when transferring paged fragments between socket buffers. The flaw breaks an invariant relied upon by IPsec ESP input processing, which may then decrypt data in-place over page-cache-backed fragments belonging to other contexts. No public exploit identified at time of analysis, EPSS sits at 0.02%, and the issue is patched across multiple stable trees.

RemediationAI

Vendor-released patches are available across all maintained stable branches - upgrade to Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, or mainline 7.1-rc5 (or any later release on the same series), or apply the corresponding stable commits listed at git.kernel.org/stable (e.g., 3599e6b3cc1a, 2f2b16022a2e, 9d3e5fd19fe1, 78bf6b6bb195, 760e1addc27b, 3bd9e113d500, 3884358a9286, fbeab9555564, 179f1852bdedc, 12401fcfb01f, 989214c66884, fc6eb39c55e9, ff375cc75f91, 9bc9d6d6967a). Distribution users should track their vendor's CVE-2026-43503 advisory and install the matching kernel package; reboot is required for kernel updates unless livepatch coverage is offered by the distribution. As a compensating control until patching, sites that do not require IPsec on receiving hosts can unload or disable the esp4/esp6 modules (modprobe -r esp4 esp6) which removes the vulnerable in-place decryption path at the cost of breaking any tunneled or transport-mode IPsec traffic; sites that do require IPsec can reduce exposure by avoiding sendfile/MSG_ZEROCOPY producers on the same hosts, though this is a partial mitigation and may regress throughput for file-serving workloads.

Affected VersionsENISA

Linux patch: 6.12.91
Linux patch: 5.15.208
Linux patch: 6.1.174
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3bd9e113d50034db99d7ef69fd8e5242d15e414a
Linux patch: 6.6.141
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3884358a9286b17f389a72b1426fc4547c23c111
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <48f6a5356a33dd78e7144ae1faef95ffc990aae0
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <ff375cc75f9167168db38e0464a482d5fbc8d81d
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <9bc9d6d6967a2239aa57af2aa53554eddd640d20
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <9d3e5fd19fe1063bf607219e8562fbd567b8e8d5
Linux patch: 0
Linux patch: 7.1-rc5
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <12401fcfb01f53ccc63ab0a3246570fe8f3105ee
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <3599e6b3cc1ada96883d496a50a210d3afbb6987
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8
Linux patch: 7.0.10
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c
Linux patch: 6.18.33
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <fbeab9555564a1b98e8582cd106dfe46c4606991
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <989214c66884d70716d83dc1d0bf5e16287bf349
Linux 3.9
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <179f1852bdedc300e373e807cc102cd81feff196
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e
Linux patch: 5.10.257
Linux cef401de7be8c4e155c6746bfccf721a4fa5fab9 <78bf6b6bb19541d19fbda6242e7cfe2c682763c0

Affected Packages

euvd linux no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 1 package in euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

The bug lives in net/core/skbuff.c, specifically the skb_try_coalesce() helper used by TCP receive coalescing to merge adjacent socket buffers and reduce per-packet overhead. The SKBFL_SHARED_FRAG flag indicates that a paged fragment is externally owned (e.g., backed by the page cache via sendfile/MSG_ZEROCOPY), and downstream code uses skb_has_shared_frag() to decide whether the buffer must be copied via skb_cow_data() before in-place mutation. When coalesce moved frag descriptors from a SHARED_FRAG-marked source skb into an unmarked destination, the marker was dropped, causing ESP input on IPsec-protected TCP flows to perform in-place decryption over page-cache pages it does not own - corrupting those pages and leaking plaintext into file-backed memory. The CPE entries (cpe:2.3:a:linux:linux:*) cover the upstream kernel tree from 3.9 forward where skb_try_coalesce exists. No CWE is assigned, but the defect maps cleanly to CWE-665 (Improper Initialization) or CWE-471 (Modification of Assumed-Immutable Data).

Know when the next one hits your stack

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (Linux) PRIMARY 8.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
SUSE HIGH
Red Hat 7.0 HIGH

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

4
CVSS changed
May 30, 2026 - 11:22 NVD
8.8 (HIGH)
Patch available
May 26, 2026 - 14:16 EUVD
CVE Published
May 23, 2026 - 11:44 nvd
UNKNOWN (no severity yet)
CVE Published
May 23, 2026 - 11:44 nvd
HIGH 8.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: preserve shared-frag marker during coalescing

skb_try_coalesce() can attach paged frags from @from to @to. If @from has SKBFL_SHARED_FRAG set, the resulting @to skb can contain the same externally-owned or page-cache-backed frags, but the shared-frag marker is currently lost.

That breaks the invariant relied on by later in-place writers. In particular, ESP input checks skb_has_shared_frag() before deciding whether an uncloned nonlinear skb can skip skb_cow_data(). If TCP receive coalescing has moved shared frags into an unmarked skb, ESP can see skb_has_shared_frag() as false and decrypt in place over page-cache backed frags.

Propagate SKBFL_SHARED_FRAG when skb_try_coalesce() transfers paged frags. The tailroom copy path does not need the marker because it copies bytes into @to's linear data rather than transferring frag descriptors.

Executive ViewAI

Why It Matters

A memory corruption vulnerability in the Linux kernel's network processing layer (CVE-2026-43503, CVSS 8.8) could enable attackers to access sensitive data from system memory across isolated contexts, creating a confidentiality risk for encrypted network traffic. No public exploit identified at time of analysis. Organizations running affected Linux kernel versions should prioritize patching to eliminate this data exposure risk.

Business Impact: High
Compensating Controls

Apply vendor patch.

Threat Intelligence Overview

EPSS Score
0.0%
Top 93% exploitable
Exploit
POC
Public exploit code exists
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS MSRC POC (1) Vendor GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC Yes
EPSS 0.0%
Patch available Yes
Active threat Yes
Deciding rule
Active threat signals + CRITICAL/HIGH severity
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision· derived
Scheduled
Exploitation· derived
Active
System Exposure· derived
Small
Automatable· derived
No
Human Impact
High

Priority Score

79
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +44
PoC: +20
Weaponized: +15
Threat intel: 0
Gov advisory: 0

Attack Technique

Information Disclosure MEDIUM

Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.

Same weakness CWE-664 – Improper Control of a Resource Through its Lifetime

View all
CVE-2022-27518 CRITICAL
9.8
CVE-2024-22365 MEDIUM POC
5.5
CVE-2022-28287 MEDIUM POC
6.5
CVE-2022-22249 MEDIUM POC
6.5
CVE-2022-31153 MEDIUM POC
6.5
CVE-2026-86203 MEDIUM POC
6.3
CVE-2026-20274 CRITICAL
9.8
CVE-2026-20353 CRITICAL
9.8

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2025-68613 HIGH POC
8.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5

Vendor StatusVendor

SUSE

Severity: High
Product Status
Container suse/sl-micro/6.0/base-os-container:2.1.3-7.145 Container suse/sl-micro/6.1/base-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/kvm-os-container:2.1.3-6.162 Container suse/sl-micro/6.1/kvm-os-container:2.2.1-5.132 Affected
Container suse/sl-micro/6.0/rt-os-container:2.1.3-7.176 Container suse/sl-micro/6.1/rt-os-container:2.2.1-5.125 Affected
Image SLES-Azure-Basic Image SLES-EC2 Image SLES-Hardened-BYOS-Azure Image SLES-SAPCAL-Azure Affected
SUSE Linux Enterprise Micro 5.3 Fixed

References

Advisories & patches
ADVISORY https://git.kernel.org/stable/c/12401fcfb01f53ccc63ab0a3246570fe8f3105ee ADVISORY https://git.kernel.org/stable/c/179f1852bdedc300e373e807cc102cd81feff196 ADVISORY https://git.kernel.org/stable/c/48f6a5356a33dd78e7144ae1faef95ffc990aae0 ADVISORY https://git.kernel.org/stable/c/989214c66884d70716d83dc1d0bf5e16287bf349 ADVISORY https://git.kernel.org/stable/c/9bc9d6d6967a2239aa57af2aa53554eddd640d20 ADVISORY https://git.kernel.org/stable/c/fbeab9555564a1b98e8582cd106dfe46c4606991 ADVISORY https://git.kernel.org/stable/c/fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8 ADVISORY https://git.kernel.org/stable/c/ff375cc75f9167168db38e0464a482d5fbc8d81d ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-43503 ADVISORY https://seclists.org/oss-sec/2026/q3/11 ADVISORY https://ubuntu.com/security/notices/USN-8370-1 ADVISORY https://ubuntu.com/security/notices/USN-8371-1 ADVISORY https://vuldb.com/vuln/365335 ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:2111/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21834/ ADVISORY https://www.suse.com/support/update/SUSE-SU-2026:21841/ REF https://access.redhat.com/errata/RHSA-2026:19521 REF https://access.redhat.com/errata/RHSA-2026:19540 REF https://access.redhat.com/errata/RHSA-2026:19568 REF https://access.redhat.com/errata/RHSA-2026:19569 REF https://access.redhat.com/errata/RHSA-2026:19664 REF https://access.redhat.com/errata/RHSA-2026:19666 REF https://access.redhat.com/errata/RHSA-2026:19705 REF https://access.redhat.com/errata/RHSA-2026:19711 REF https://access.redhat.com/errata/RHSA-2026:19875 REF https://access.redhat.com/errata/RHSA-2026:20051 REF https://access.redhat.com/errata/RHSA-2026:20054 REF https://access.redhat.com/errata/RHSA-2026:20087 REF https://access.redhat.com/errata/RHSA-2026:20129 REF https://access.redhat.com/errata/RHSA-2026:20130 REF https://access.redhat.com/errata/RHSA-2026:20299 REF https://access.redhat.com/errata/RHSA-2026:20593 REF https://access.redhat.com/errata/RHSA-2026:21656 REF https://access.redhat.com/errata/RHSA-2026:21690 REF https://access.redhat.com/errata/RHSA-2026:21695 REF https://access.redhat.com/errata/RHSA-2026:21702 REF https://access.redhat.com/errata/RHSA-2026:23233 REF https://access.redhat.com/errata/RHSA-2026:23240 REF https://access.redhat.com/errata/RHSA-2026:23245 REF https://access.redhat.com/errata/RHSA-2026:23468 REF https://access.redhat.com/errata/RHSA-2026:23469 REF https://access.redhat.com/errata/RHSA-2026:23470 REF https://access.redhat.com/errata/RHSA-2026:23471 REF https://access.redhat.com/errata/RHSA-2026:24814 REF https://access.redhat.com/errata/RHSA-2026:25044 REF https://access.redhat.com/errata/RHSA-2026:33486 REF https://access.redhat.com/security/cve/CVE-2026-43503 REF https://bugzilla.redhat.com/show_bug.cgi?id=2480902 REF https://cert-portal.siemens.com/productcert/html/ssa-784472.html REF https://git.kernel.org/stable/c/2f2b16022a2e10ca7bccfb98db5ed2ec0f72641c REF https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987 REF https://git.kernel.org/stable/c/3884358a9286b17f389a72b1426fc4547c23c111 REF https://git.kernel.org/stable/c/3bd9e113d50034db99d7ef69fd8e5242d15e414a REF https://git.kernel.org/stable/c/760e1addc27ba1a7beb4a0a7e8b3e9ec49e7a34e REF https://git.kernel.org/stable/c/78bf6b6bb19541d19fbda6242e7cfe2c682763c0 REF https://git.kernel.org/stable/c/9d3e5fd19fe1063bf607219e8562fbd567b8e8d5 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43503.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy