chernstepanov/dirtyfrag-for-dummiesTechnical analysis and cleaned-up PoC for CVE-2026-43284 (Dirty Frag), a Linux kernel xfrm-ESP vulnerability enabling page cache corruption via splice() and in-place replay-window writes.
This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284.
The issue belongs to the broader Dirty Frag class discovered by Hyunwoo Kim (@v4bel). A related RxRPC variant is tracked separately as CVE-2026-43500.
The purpose of this material is:
splice(), skb fragments, file-backed pages, and page cache corruption;This repository is not an exploitation guide.
In practical terms, the repository expands and documents the original public Dirty Frag ESP proof-of-concept in a more inspectable form. The included materials are intended for 64-bit Linux systems only.
At a high level, the issue is tied to faulty in-place handling in the xfrm ESP receive path.
The chain looks like this:
unshare(CLONE_NEWUSER | CLONE_NEWNET);/usr/bin/su are moved into a UDP packet path through splice() and SPLICE_F_MOVE;skb fragment;
poc/dirtyfrag_sim.cpp — cleaned-up C++ research source artifactpoc/dirtyfrag — compiled 64-bit binary artifactdocs/dirtyfrag-flow.png — generated publication diagramThe repository also includes a compiled C++ binary artifact built from the C++ source file. Example build command:
g++ -std=c++17 -o poc/dirtyfrag poc/dirtyfrag.cpp
Kernels from cac2661c53f3 (2017-01-17) up to f4c50a4034e6 (2026-05-05, fix released).
The effective exposure window is about 9 years.
This repository is provided for defensive research, documentation, and educational analysis only.
Do not use it to target real systems, modify privileged executables, or obtain unauthorized access.
The vulnerability class was discovered by Hyunwoo Kim (@v4bel). This repository is an independent cleaned-up research artifact intended for faster analysis.
f4c50a4034e6