CVE-2026-43284
Linux Kernel 4.11 – 5.10.255
Raw vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HSummary
CVE-2026-43284 is a high-severity Write-what-where Condition (CWE-123) vulnerability in Linux Linux Kernel. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 0.2% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SI-16 (Memory Protection) and SA-8 (Security and Privacy Engineering Principles) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
The vulnerability is a write-what-where flaw (CWE-123) in the Linux kernel's XFRM/ESP input path. When MSG_SPLICE_PAGES attaches pipe pages to a UDP datagram skb, the IPv4/IPv6 datagram splice code omitted the SKBFL_SHARED_FRAG flag that TCP sets after skb_splice_from_iter. ESP therefore treated the skb as an ordinary uncloned nonlinear buffer, took the no-COW fast path, and performed in-place decryption over memory the skb did not own.
A local attacker with the ability to send UDP packets that traverse ESP can supply such shared fragments and cause the kernel to corrupt arbitrary memory during decryption, yielding full confidentiality, integrity, and availability impact on the host (CVSS 8.8, local, no user interaction required). The flaw affects any kernel using ESP-over-UDP with pipe-backed skbs; remote exploitation is not described.
The referenced stable commits (50ed1e787310, 52646cbd00e7, 5d55c7336f80, 71a1d9d985d2, 8253aab4659c) implement the fix by setting SKBFL_SHARED_FRAG on IPv4/IPv6 datagram splice paths and forcing ESP input to call skb_cow_data when the flag is present. ESP output paths were left unchanged because they are already unreachable for nonlinear skbs.
EPSS rose from a low baseline to a peak of 0.3845 (current 0.2634), indicating that exploitation interest increased after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2026-28535
Vulnerability Data
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later…
more
paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 4 hardening rules · 4 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
Memory-protection mechanisms block unauthorized writes to arbitrary locations even if a write-what-where primitive exists.
Secure engineering principles require memory-safe coding and bounds checking that eliminate the root cause of write-what-where flaws.
Process isolation confines the blast radius of an arbitrary write so it cannot affect other domains.
Input validation directly stops malformed data from triggering buffer overflows that produce arbitrary write-what-where conditions.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly prevent arbitrary write conditions via safe coding, bounds checking, and memory-safe constructs.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing in development and acceptance can detect write-what-where conditions before deployment.
Secure development lifecycle practices directly reduce the likelihood of write-what-where flaws such as buffer overflows.
Application security requirements can mandate input validation and bounds checking that mitigate arbitrary write conditions.
Secure architecture and engineering principles discourage unsafe memory handling that leads to write-what-where vulnerabilities.
Secure coding standards explicitly forbid unsafe buffer operations that enable arbitrary memory writes.
Change management processes help ensure security fixes for such weaknesses are properly deployed.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248592 OL 8 must clear memory when it is freed to prevent use-after-free attacks. prevents CWE-123
RHEL 8 (1 rule)
- V-230279 RHEL 8 must clear memory when it is freed to prevent use-after-free attacks. prevents CWE-123
Windows 10 (1 rule)
- V-220727 Structured Exception Handling Overwrite Protection (SEHOP) must be enabled. prevents CWE-123
Windows 11 (1 rule)
- V-253284 Structured Exception Handling Overwrite Protection (SEHOP) must be enabled. prevents CWE-123