CVE-2026-43503: Linux Kernel Privilege Escalation Bug

CVE-2026-43503 Overview

CVE-2026-43503 is a Linux kernel vulnerability in the net/skbuff subsystem. Two frag-transfer helpers, __pskb_copy_fclone() and skb_shift(), fail to propagate the SKBFL_SHARED_FRAG bit in skb_shinfo()->flags when moving fragments from a source to a destination socket buffer (skb). The same omission exists in skb_gro_receive(), skb_gro_receive_list(), tcp_clone_payload(), and skb_segment(). Downstream consumers such as ESP input (esp4.c, esp6.c) rely on skb_has_shared_frag() to decide whether shared pages must be copied via skb_cow_data(). The mismatch can let an unprivileged user trigger stray writes into the page cache of a root-owned read-only file.

Critical Impact
An unprivileged local user can corrupt the page cache of root-owned read-only files via authencesn-ESN stray writes, leveraging a single nft 'dup to <local>' rule or any nf_dup_ipv4() / xt_TEE caller.

Affected Products

Linux kernel (mainline net/skbuff subsystem)
Kernel networking paths consuming skb_has_shared_frag() — notably ESP input handlers (esp4.c, esp6.c)
Stable kernel branches receiving the referenced backport commits

Discovery Timeline

2026-05-23 - CVE-2026-43503 published to NVD
2026-05-26 - Last updated in NVD database

Technical Details for CVE-2026-43503

Vulnerability Analysis

The defect is a metadata propagation gap in skb fragment-transfer helpers. __pskb_copy_fclone() copies fragment descriptors and then defers remaining shinfo metadata to skb_copy_header(), which only carries over gso_size, gso_segs, and gso_type. The skb_shinfo()->flags field is never touched. skb_shift() moves frag descriptors directly and likewise leaves flags untouched.

The destination skb retains references to externally-owned or page-cache-backed pages while reporting skb_has_shared_frag() as false. In-place writers that gate skb_cow_data() on this predicate then perform direct writes into shared pages. ESP input is the confirmed exploitable consumer through the authencesn-ESN code path.

The same omission propagates to GRO accumulation (skb_gro_receive() and skb_gro_receive_list()), TCP MTU probe construction (tcp_clone_payload()), and segmentation (skb_segment()), where per-iteration flag merging considers only head_skb's flag and ignores frag_skb rebinding.

Root Cause

The root cause is incomplete shinfo metadata copying. Helpers that move frag descriptors do not fold the source's SKBFL_SHARED_FRAG bit into the destination's skb_shinfo()->flags. Downstream code therefore treats shared-page-backed skbs as exclusively owned and bypasses copy-on-write protection. This is an information / state-tracking flaw with memory corruption consequences in the page cache.

Attack Vector

The exploitation path requires a local unprivileged user able to introduce a packet duplication rule, for example via nft 'dup to <local>', nf_dup_ipv4(), or xt_TEE. The duplicated packet passes through pskb_copy(), stripping the shared-frag marker. When it later reaches esp_input(), the authencesn-ESN path writes into the still-shared page, corrupting the page cache of a root-owned read-only file. See the upstream fix in Kernel Git Commit 12401fcf and related backports for the full mechanism.

The vulnerability is described in prose only; no public proof-of-concept code is referenced in the advisory. The fix sets SKBFL_SHARED_FRAG on the destination whenever frag descriptors are actually moved from the source, and folds frag_skb's flag into nskb at both rebinding sites in skb_segment().

Detection Methods for CVE-2026-43503

Indicators of Compromise

Unexpected modifications or checksum mismatches in read-only files backed by the page cache, particularly system binaries and configuration files owned by root.
Unprivileged processes creating netfilter dup rules or loading xt_TEE targets in conjunction with ESP/IPsec traffic.
Kernel logs showing IPsec decapsulation activity (esp_input) on interfaces also targeted by packet duplication rules.

Detection Strategies

Audit running kernels against the fixed commits and stable backports listed in the references; flag any host running an unpatched build.
Monitor for unusual nft, iptables -j TEE, or nf_dup_ipv4 rule creation by non-root users or containers with CAP_NET_ADMIN in user namespaces.
Correlate ESP/IPsec traffic on local destinations with simultaneous packet duplication targets, which is uncommon in benign workloads.

Monitoring Recommendations

Enable kernel audit rules on nf_tables and iptables netlink interfaces to capture rule installation events.
Track file integrity of root-owned read-only files using a host integrity monitoring control, with alerting on unexpected mtime or content drift.
Capture and retain kernel version inventory across the fleet to confirm patch coverage after rollout.

How to Mitigate CVE-2026-43503

Immediate Actions Required

Apply the upstream kernel patches referenced in the advisory and reboot affected hosts.
Restrict creation of netfilter packet-duplication rules to trusted administrators; disable user namespaces with CAP_NET_ADMIN where they are not required.
Inventory hosts terminating IPsec/ESP traffic locally and prioritize them for patching.

Patch Information

Fixes are available in the mainline and stable kernel trees. Refer to the upstream commits: Kernel Git Commit 12401fcf, Kernel Git Commit 179f1852, Kernel Git Commit 48f6a535, Kernel Git Commit 989214c6, Kernel Git Commit 9bc9d6d6, Kernel Git Commit fbeab955, Kernel Git Commit fc6eb39c, and Kernel Git Commit ff375cc7. Distribution vendors should issue corresponding stable kernel updates.

Workarounds

Disable or restrict loading of xt_TEE and nf_dup_ipv4/nf_dup_ipv6 modules where not operationally required.
Remove unprivileged user namespace access (kernel.unprivileged_userns_clone=0) on systems where containerized workloads do not need it.
Terminate IPsec/ESP on dedicated gateway hosts rather than general-purpose multi-tenant systems until patches are deployed.

bash

# Configuration example: restrict unprivileged netfilter access and verify patch level
sysctl -w kernel.unprivileged_userns_clone=0
modprobe -r xt_TEE 2>/dev/null || true
modprobe -r nf_dup_ipv4 2>/dev/null || true
modprobe -r nf_dup_ipv6 2>/dev/null || true
uname -r