DirtyFrag Linux Kernel Bugs Enable Root Access Across Major Distributions

Summary

DirtyFrag exploits two Linux kernel page-cache write bugs for local root access. A public PoC is available, but no in-the-wild exploitation is confirmed; one bug remains unpatched, and distribution kernels had not yet shipped fixes.

Key points

CVE-2026-43284 affects the xfrm-ESP path and requires namespace creation privileges; its fix was in mainline Linux only at disclosure.
CVE-2026-43500 affects RxRPC and can require no special privileges when the module loads by default; no fix had been merged into a kernel tree.
The bugs can let an unprivileged process overwrite read-only file-backed memory to obtain a root shell.
The report says the vulnerabilities affect major distributions including Ubuntu, RHEL, Fedora, CentOS Stream, AlmaLinux, and openSUSE.
A public proof of concept appeared on the disclosure date, and compiled binaries appeared on VirusTotal within seven minutes.
No exploitation campaign was confirmed, though Netskope telemetry indicated exploit interest in seven countries within 24 hours.
The article recommends blocking the relevant kernel modules as an interim mitigation and cautions that unloading fails if modules are in use.

Article Details

Vulnerability Types: Kernel page-cache write vulnerabilities caused by deterministic logic errors, allowing an unprivileged process to overwrite read-only file-backed memory
Exploitation Status: not_reported
Exploit Availability: public_poc
Patch Status: partial
Workarounds: Block loading the esp4, esp6, and rxrpc kernel modules and attempt to unload them; the article notes unloading may fail if a module is already loaded and in use.