CVE-2026-43503

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: net: skbuff: propagate shared-frag marker through frag-transfer helpers Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving frags from source to destination. __pskb_copy_fclone() defers the rest of the shinfo metadata to skb_copy_header() after copying frag descriptors, but that helper only carries over gso_{size,segs, type} and never touches skb_shinfo()->flags; skb_shift() moves frag descriptors directly and leaves flags untouched....

Affected product and versions

Product

Linux Linux, NVIDIA for RHEL 10, Red Hat Enterprise Linux 10

Affected versions

>= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < fbeab9555564a1b98e8582cd106dfe46c4606991, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 179f1852bdedc300e373e807cc102cd81feff196, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 12401fcfb01f53ccc63ab0a3246570fe8f3105ee, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 989214c66884d70716d83dc1d0bf5e16287bf349, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < fc6eb39c55e97df2f94ad974b8a5bbcd019da2c8, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < ff375cc75f9167168db38e0464a482d5fbc8d81d, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 9bc9d6d6967a2239aa57af2aa53554eddd640d20, >= cef401de7be8c4e155c6746bfccf721a4fa5fab9 < 48f6a5356a33dd78e7144ae1faef95ffc990aae0, >= 3.9, >= 3.9 < 5.10.257, >= 5.11 < 5.15.208, >= 5.16 < 6.1.174, >= 6.2 < 6.6.141, >= 6.7 < 6.12.91, >= 6.13 < 6.18.33, >= 6.19 < 7.0.10, 7.1

Fixed versions

5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10

Technical data

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

CWE

CWE-664