Dirty Frag Deep Technical Analysis

CVE-2026-43284 (xfrm-ESP) / CVE-2026-43500 (RxRPC)

Linux kernel local privilege escalation vulnerability — PoC reverse engineering · Shellcode breakdown · Patch principles · Detection script

Vulnerability Overview

Dirty Frag exploits two independent vulnerabilities, xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write, in a chained manner to achieve privilege escalation from a local unprivileged user to root on almost all mainstream Linux distributions.

• Deterministic logic vulnerability, no race conditions, 100% success rate
• Fully bypasses the Copy Fail mitigation
• Affected scope: almost all Linux kernels from 2017 to the present

File Description

Quick Detection

# One-line quick detection
lsmod | grep -qE "esp4|rxrpc" && echo "[!] Vulnerable" || echo "[+] Safe"

# Or use the full detection script
bash dirtyfrag-check.sh

Temporary Mitigation

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches"

⚠️ Before applying the mitigation, confirm the system is not using IPsec VPN / SD-WAN / IPsec encryption between K8s pods

Real-World Verification

OS:      Ubuntu 22.04.5 LTS
Kernel:  5.15.0-171-generic
User:    ubuntu (uid=1000) → root (uid=0)
Variant: xfrm-ESP Page-Cache Write
Time:    ~8 seconds

Acknowledgments

• Vulnerability discoverer: Hyunwoo Kim (@v4bel)
• Dirty Frag official repository

Disclaimer

This article is for security research and learning purposes only. Do not use it for unauthorized system testing.

Author: Bomb

WeChat: AK7777177 (security research exchange, vulnerability analysis collaboration)

Star History