CVE-2026-43503

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: skbuff: propagate shared-frag marker through frag-transfer helpers

Two frag-transfer helpers (__pskb_copy_fclone() and skb_shift()) fail

to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when

moving frags from source to destination. __pskb_copy_fclone() defers

the rest of the shinfo metadata to skb_copy_header() after copying

frag descriptors, but that helper only carries over gso_{size,segs,

type} and never touches skb_shinfo()->flags; skb_shift() moves frag

descriptors directly and leaves flags untouched. As a result, the

destination skb keeps a reference to the same externally-owned or

page-cache-backed pages while reporting skb_has_shared_frag() as

false.

The mismatch is harmful in any in-place writer that uses

skb_has_shared_frag() to decide whether shared pages must be detoured

through skb_cow_data(). ESP input is one such writer (esp4.c,

esp6.c), and a single nft 'dup to <local>' rule -- o

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References