Dirty Frag Linux Kernel Flaws Could Let Local Attackers Gain Root
Summary
Dirty Frag (CVE-2026-43284 and CVE-2026-43500) chains Linux kernel ESP and RxRPC flaws to enable local privilege escalation. No official patches are available; disabling vulnerable modules is a temporary mitigation.
Key points
- The vulnerability chain uses page-cache write flaws in the Linux kernel’s ESP (IPsec) and RxRPC subsystems to enable root access.
- Exploitation requires local access, vulnerable kernel interfaces, and the ability to manipulate page-backed buffers; it may also require elevated permissions such as CAP_NET_ADMIN.
- The affected code paths date back to approximately 2017 for ESP and 2023 for RxRPC. The article lists several affected distributions, including Ubuntu, RHEL, Fedora, and openSUSE; the full version scope remains under investigation.
- No official patches are available, though early patched kernels are available in some testing repositories.
- A temporary mitigation is to disable the esp4, esp6, and rxrpc modules, after assessing possible disruption to IPsec and AFS-based environments.
- The article recommends restricting local access and unnecessary capabilities, enforcing SELinux or AppArmor, monitoring for suspicious privilege escalation, and applying kernel updates when available.
Article Details
- Vulnerability Types
- Linux kernel page-cache write vulnerability
- Local privilege escalation
- Affected Versions
- Linux kernel ESP code path present since approximately 2017; exact versions not specified
- Linux kernel RxRPC code path present since approximately 2023; exact versions not specified
- Ubuntu: multiple tested versions; exact versions not specified
- RHEL 8 / 9 / 10
- CentOS Stream 10
- AlmaLinux 8 / 9 / 10
- Fedora: recent versions; exact versions not specified
- openSUSE Tumbleweed
- OpenShift 4: potentially affected
- Exploitation Status
- unknown
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- Temporarily disable the esp4, esp6, and rxrpc kernel modules; the article warns this may break IPsec functionality or affect AFS-based environments.
- Restrict shell access, enforce least privilege, and avoid granting unnecessary capabilities such as CAP_NET_ADMIN.
MITRE ATT&CK
CVE
CVE-2026-31431This vulnerability is a successor to Copy Fail (CVE-2026-31431), and was discovered by Hyunwoo Kim (@v4bel).CVE-2026-43284Linux kernel local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assigned CVE-2026-43284 and CVE-2026-43500, enables attackers with local access to obtain root privileges by exploiting flawsCVE-2026-43500local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assigned CVE-2026-43284 and CVE-2026-43500, enables attackers with local access to obtain root privileges by exploiting flaws in the ESP (IPsec)
People
Products
AlmaLinuxAlmaLinux 8 / 9 / 10 AffectedAppArmorEnsure SELinux/AppArmor is enforcedCentOS StreamCentOS Stream 10 AffectedFedoraFedora (recent versions) AffectedKubernetesas CAP_NET_ADMIN. This means exploitation is less likely in hardened containerized environments (e.g., Kubernetes with default seccomp profiles). However, the risk remains significant for virtual machines or lessLinux kernelA newly disclosed Linux kernel local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assigned CVE-2026-43284 and CVE-2026-43500, enables attackers with local access to obtain root privileges byOpenShiftOpenShift 4 Potentially affectedopenSUSE TumbleweedopenSUSE Tumbleweed AffectedRHELRHEL 8 / 9 / 10 AffectedSELinuxEnsure SELinux/AppArmor is enforcedUbuntuUbuntu (multiple versions) Affected (tested)