# xfrm: esp: avoid in-place decrypt on shared skb frags

CVE record · `CVE-2026-43284`

- **Identifiers:** `CVE-2026-43284`
- **State:** Confirmed
- **Severity:** CVSS 8.8 High
- **Critical:** Yes: CVSS 7+ and EPSS
- **CNA:** Linux
- **Weakness (CWE):** [CWE-123](https://cwe.mitre.org/data/definitions/123.html)
- **Tags:** [CWE-123](https://agentprime.io/advisories/tag/cwe-123.md)
- **Technologies:** [Linux kernel](https://agentprime.io/advisories/technology/linux-kernel.md)
- **Published:** 8 May 2026
- **Updated:** 15 Oct 2026
- **Reviewed by a person:** No

Published by the CVE Program (CNA: Linux) at 8 May 2026, 07:21 UTC. agentprime has not analysed this yet, so whether it affects any app is not known. This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it.

## Critical

Critical, because:

- CVSS score 8.8 (7.0 or more) and EPSS 0.94 (0.1 or more): a high score and a real chance of exploitation in the next 30 days.

How we decide what’s critical: <https://agentprime.io/advisories/critical.md>

## Affected products, as the CNA wrote them

- Vendor: Linux. Product: Linux.
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before a6cb440f274a22456ef3e86b457344f1678f38f9` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before ab8b995323e5237041472d07e5055f5f7dcdf15b` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before fe785bb3a8096dffcc4048a85cd0c83337eeecad` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before 5d55c7336f8032d434adcc5fab987ccc93a44aec` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before 8253aab4659ca16116b522203c2a6b18dccacea7` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before 50ed1e7873100f77abad20fd31c51029bc49cd03` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before b54edf1e9a3fd3491bdcb82a21f8d21315271e0d` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before 71a1d9d985d26716f74d21f18ee8cac821b06e97` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before 52646cbd00e765a6db9c3afe9535f26218276034` (git)
  - affected: `cac2661c53f35cbe651bef9b07026a5a05ab8ce0 to before f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4` (git)
  - Other versions: unaffected
- Vendor: Linux. Product: Linux.
  - affected: `4.11`
  - unaffected: `before 4.11` (semver)
  - unaffected: `5.10.255 to 5.10.*, inclusive` (semver)
  - unaffected: `5.15.205 to 5.15.*, inclusive` (semver)
  - unaffected: `5.15.206 to 5.15.*, inclusive` (semver)
  - unaffected: `6.1.171 to 6.1.*, inclusive` (semver)
  - unaffected: `6.1.172 to 6.1.*, inclusive` (semver)
  - unaffected: `6.6.138 to 6.6.*, inclusive` (semver)
  - unaffected: `6.12.87 to 6.12.*, inclusive` (semver)
  - unaffected: `6.18.28 to 6.18.*, inclusive` (semver)
  - unaffected: `7.0.5 to 7.0.*, inclusive` (semver)
  - unaffected: `7.1 to *, inclusive` (original_commit_for_fix)
  - Other versions: affected

## Not analysed yet

We haven’t published our own analysis of this CVE. If a person reviews it, this page will say what’s affected and what has to be true for it to matter.

## Severity and exploitation

- 8.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H`, from CNA (Linux) (used for this record)
- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H`, from ADP (CISA-ADP)
- 7.8 High, CVSS 3.1: `CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`, from ADP (redhat-SADP)

- **CISA KEV:** Not listed.
- **EPSS:** 0.94, the 99th percentile, on 5 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

## Timeline

This record came from the full history of the CVE Program, published 8 May 2026. New records show when each source confirmed them.

## Sources

- [CVE List: CVE-2026-43284](https://www.cve.org/CVERecord?id=CVE-2026-43284)
- [NVD: CVE-2026-43284](https://nvd.nist.gov/vuln/detail/CVE-2026-43284)

### References from the CNA

- <https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9>
- <https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b>
- <https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad>
- <https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec>
- <https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7>
- <https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03>
- <https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d>
- <https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97>
- <https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034>
- <https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4>

Facts on this page come from the CVE List as the CNA published them, with CVSS from the sources named above, CISA KEV and FIRST EPSS. Vendors, products and versions are shown as the CNA wrote them. We don’t reproduce the CVE’s description.

## Check whether this affects you

This CVE names a vendor and product rather than a package, so the lockfile check doesn’t match it. Compare the affected versions above with what you run.

- With the agentprime MCP server (<https://api.agentprime.io/mcp>), `get_advisory` returns this record and `search_advisories` finds related ones. Setup: <https://agentprime.io/mcp.md>
- As JSON: <https://api.agentprime.io/v1/advisories/CVE-2026-43284>
- Everything that needs attention now: <https://agentprime.io/advisories/critical.md>

---

The web page: <https://agentprime.io/advisories/CVE-2026-43284/>. Everything for agents: <https://agentprime.io/llms.txt>.