Junglewise Threat Intelligence

CVE-2026-43503: Linux Kernel data corruption via skbuff shared-frag marker omission

CVE-2026-43503 · Severity: info · CVSS 0 · Published 2026-05-23

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's networking component could allow an unprivileged user to overwrite read-only system files. This occurs because the system fails to correctly track when data buffers are shared between different parts of the network stack, leading to situations where sensitive data in the system's page cache is accidentally modified. This could result in a complete compromise of the system's integrity or unauthorized data modification.

Technical details

A flaw exists in the Linux kernel's skbuff (socket buffer) management where frag-transfer helpers, including __pskb_copy_fclone(), skb_shift(), and skb_gro_receive(), fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags. This bit is used by in-place writers, such as the IPsec ESP implementation, to determine if data resides in shared pages that require a copy-on-write (COW) operation via skb_cow_data(). When the marker is stripped, the kernel may perform in-place decryption or writes directly into shared pages, such as those backed by the page cache. An attacker can trigger this condition using common networking tools or rules (e.g., nft 'dup') to cause stray writes into root-owned, read-only files. The issue has been patched across multiple stable kernel branches by ensuring the SKBFL_SHARED_FRAG flag is preserved during fragment transfers.

Affected products

  • Linux Linux Kernel All versions prior to the May 2026 patches

Timeline

  • 2026-05-16: other: Patch authored by Hyunwoo Kim
  • 2026-05-23: patched: Patches committed to stable kernel trees by Greg Kroah-Hartman
  • 2026-05-23: advisory: CVE-2026-43503 published

References