CVE-2026-43284
xfrm: esp: avoid in-place decrypt on shared skb frags
- Published
- May 8, 2026
- Updated
- Oct 15, 2026
- Assigning CNA
- Linux
- Evidence observed
- May 27, 2026
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 99.8%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
Summary
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().
Sources
modules/exploits/linux/local/cve_2026_43284_dirty_frag.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/local/cve_2026_43284_dirty_frag.platform)
- verification: check_declared($.exploit_linux/local/cve_2026_43284_dirty_frag.check)
- CVE-2026-43284Exploit
CVE-2026-43284
- DirtyFragExploit
Add go CVE-2026-43284 / CVE-2026-43500 (dirtyfrag) local privilege escalation exploit
- Dirty-Frag-CVE-2026-43284Research
Lab detection exercise for DirtyFrag (CVE-2026-43284) - Linux kernel privilege escalation via xfrm-ESP page cache corruption. Full write-up covering exploit execution, detection gaps, and corrected EQL rules using Elastic Stack
Technical analysis and cleaned-up PoC for CVE-2026-43284 (Dirty Frag), a Linux kernel xfrm-ESP vulnerability enabling page cache corruption via splice() and in-place replay-window writes.
- Dirty-FragExploit
C proof-of-concept exploit for CVE-2026-43284 (Dirty Frag), a Linux kernel local privilege escalation that uses page-cache corruption to gain root on vulnerable systems.
- CVE-2026-43284Exploit
Linux kernel privilege escalation exploit chaining two page-cache write vulnerabilities (CVE-2026-43284, CVE-2026-43500) for deterministic root access on major distributions.
Automated SSH-based scanner and patcher for Linux kernel LPE vulnerabilities CVE-2026-43284 and CVE-2026-43500, with multi-host discovery, privilege escalation detection, and module blacklisting mitigation.
- CVE-2026-43284-DirtyFrag-PoCExploit
Proof-of-concept for CVE-2026-43284 — 4-byte XFRM/ESP page-cache write primitive to patch a setuid binary (x86_64, user namespaces). Includes kernel preflight + SUID scan.
- DIRTYFAILExploit
Detector + PoC for Linux page-cache write vulnerabilities: Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284/43500). Authorized security research only.
- Dirty-Frag-CVE-2026-43284Research
A report on Dirty Frag, which is a Linux Local Privilege Escalation (LPE) vulnerability chain that allows an unprivileged user to gain root access
- CVE-2026-43284Exploit
Dirty Frag - kernel Linux critical Vulnerability
- dirtyfrag-patchesPatch
Kernel patches for Dirty Frag vulnerability (CVE-2026-43284, CVE-2026-43500)
- DirtyFrag-goExploit
A Go implementation of dirtyfrag (CVE-2026-43284 / CVE-2026-43500)
Proof-of-concept demonstrating container escape on Amazon EKS by exploiting Dirty Frag (CVE-2026-43284) kernel page-cache corruption via shared image layers and privileged DaemonSets.
TryHackMe Dirty Frag (CVE-2026-43284) — Linux LPE writeup
- CVE-2026-43284-Exploit
Local privilege escalation exploit for Linux kernel CVE-2026-43284 (Dirty Flag), providing root access on vulnerable systems.
- CVE-2026-43284-Dirty-FragExploit
Pre-compiled exploit for CVE-2026-43284 (Dirty Frag) with multi-architecture support (x86_64, i386, aarch64, armv7, riscv64, ppc64le, s390x). Includes glibc and musl static build options.
- SG-2026-0024PoC
CVE-2026-43284 and CVE-2026-43500 Dirty Frag PoC and exploit
- dirtyfragExploit
Linux kernel privilege escalation exploit chaining two page-cache write vulnerabilities (CVE-2026-43284, CVE-2026-43500) for deterministic root access on major distributions without race conditions.
- CVE-2026-43284Exploit
Deterministic Linux kernel local privilege escalation exploit chaining two page-cache write primitives (xfrm/ESP and RxRPC) for reliable root access on all major distributions since 2017.
Local privilege escalation exploit for Linux kernel CVEs CVE-2026-31431 and CVE-2026-43284, with C and Python proof-of-concept code targeting multiple distros and kernel versions.
- LSPromiseExploit
Android complete exploit chain that enables privilege escalation from a local untrusted app to root/kernel, combination of CVE-2026-49881 and CVE-2026-43284
arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page
- DirtyFragExploit
Linux kernel exploit chain (CVE-2026-43284 and CVE-2026-43500) that achieves root via xfrm-ESP and RxRPC page-cache write vulnerabilities.
- DFRootExploit
Android root tool for Samsung Galaxy S25 Ultra (SM-S938B) that chains DirtyFrag CVE-2026-43284 and CVE-2026-43499 to gain root automatically at boot via KernelSU.
- CVE-2026-43284-DIRTY-FRAG-Research
Technical analysis of CVE-2026-43284 (Dirty Frag), a Linux kernel xfrm ESP local privilege escalation enabling page-cache writes to read-only files for root compromise.
Rust implementation of CVE-2026-43284, providing a proof-of-concept exploit for the vulnerability.
- Dirty-Frag-AnalysisResearch
Dirty Frag (CVE-2026-43284/43500) - Linux Kernel LPE Deep Technical Analysis by Bomb
Se realizó una evaluación de vulnerabilidades sobre una máquina virtual con Kali Linux utilizando un script detector para la vulnerabilidad Dirty Frag, asociada a las CVE-2026-43284 y CVE-2026-43500. Posteriormente se ejecutó un Proof of Concept (PoC) público escrito en lenguaje C para validar la posibilidad de realizar una escalada local
- dirtyfrag-detection-rulesDetection
Detection rules and analysis for Dirty Frag (CVE-2026-43284/CVE-2026-43500) Linux kernel LPE vulnerability. Based on community research and health probe configurations.
- CVE-2026-43500Patch
CVE-2026-43500 / CVE-2026-31431 / CVE-2026-43284 golang hotfix
- CVE-2026-46300Exploit
CVE-2026-43284 - CVE-2026-43500 - CVE-2026-46300 Variant of dirtyfrag exploit
Automates kernel patching for CVE-2026-31431 and Dirty Frag, sets secure kernel as default in GRUB, and disables testing repo for production safety.
CVE-2026-43284 & CVE-2026-43500 discovered by Hyunwoo Kim
nu11secur1ty · linux · May 27, 2026
nu11secur1ty · linux · May 29, 2026
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.