CVE-2026-43500

A flaw was found in the Linux kernel's RxRPC networking subsystem. When a socket buffer carrying a page-cache reference reaches the RxRPC authentication verification path, the kernel performs an in-place decryption directly on the referenced page without first isolating the buffer. A low-privileged local attacker can exploit this behavior to corrupt the page-cache contents of readable files, including sensitive system files such as /etc/passwd, and obtain root privileges. Exploitation does not require unprivileged user or network namespaces, but depends on the RxRPC protocol stack being available on the target system.

This issue is classified as Important, rather than Critical severity, because exploitation requires local access to the system. A low-privileged local attacker can exploit this flaw in the Linux kernel's RxRPC subsystem to gain root privileges by overwriting sensitive system files. Exploitation does not require user interaction, potentially resulting in full compromise of confidentiality, integrity, and availability.

While the kernel source RPM for Red Hat Enterprise Linux 9 and 10 includes the rxrpc module in its build configuration, the binary RPMs that provide this module are not shipped or supported by Red Hat. The module is not installed by default and is not included in any other kernel binary package. For OpenShift Container Platform 4, the RPMs are not included in Red Hat Enterprise Linux CoreOS (RHCOS) images and is not installable through any supported cluster workflow.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.