🚨 CVE-2026-43284 - Dirty Frag 🚨

---

Universal Linux Kernel Local Privilege Escalation

📋 Overview

Dirty Frag (also known as Copy Fail 2) is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems.

Discovered by Hyunwoo Kim (@v4bel), it is a successor to the earlier Copy Fail vulnerability.

Key Details

• CVE: CVE-2026-43284 (xfrm/ESP) + CVE-2026-43500 (RxRPC)
• Severity: High (CVSS ~7.8)
• Exploitation: Reliable, deterministic root in a single command
• Disclosure Date: May 7, 2026
• Affected: Most Linux kernels since ~2017

🧩 Technical Summary

The vulnerability originates from unsafe in-place decryption of shared socket buffer (skb) fragments referencing page cache pages, particularly when using splice(2) or sendfile(2).

This provides a powerful arbitrary page cache write primitive, which can be leveraged to overwrite sensitive files in memory and achieve full root access.

Primary attack vectors:

• xfrm / ESP (esp4 / esp6)
• RxRPC (used by AFS)

📸 Demo

🚨 Impact

• Unprivileged local attacker → Root shell
• Affects virtually all major Linux distributions
• Highly reliable with no race conditions
• Bypasses many existing kernel mitigations

🛠️ Mitigation & Remediation

Recommended Fix

Update to the latest patched kernel from your distribution as soon as possible.

Fixed in mainline kernel via commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4.

Temporary Workaround

# Blacklist vulnerable modules
sudo sh -c 'printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /etc/modprobe.d/dirtyfrag.conf'

# Unload modules immediately
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true

# Drop page cache
echo 3 | sudo tee /proc/sys/vm/drop_caches >/dev/null

Note: This workaround disables IPsec and RxRPC/AFS functionality.

📊 Affected Distributions

⚠️ Disclaimer

This repository is intended for educational and defensive security purposes only.