Pin to a release tag for change control: https://raw.githubusercontent.com/haydenjames/dirty-frag-check/v1.0.4/dirty-frag-check.sh.

-q for one-line fleet output. -h for help. Exit 0 ok, 1 vulnerable, 2 unknown.

Fleet usage

Exit codes (0 ok, 1 vulnerable, 2 unknown) work with anything that aggregates by status.

Requirements

bash 4+, plus the usual awk/grep/sed/lsmod/modprobe. No root required for the check itself. Applying mitigations does need root.

What it checks

1. Module state. Whether the modules implicated by the advisory — esp4, esp6, ipcomp, ipcomp6 (CVE-2026-43284) and rxrpc (CVE-2026-43500) — are loaded, available, or absent.
2. Mitigations. Looks for modprobe blacklist files and verifies the blacklist actually wins via modprobe -n -v. Reports SELinux and AppArmor status. Detects KernelCare livepatch via kcarectl --patch-info.
3. Kernel package vs running. Catches the case where you've installed a patched kernel but haven't rebooted into it.
4. Running kernel vs known-fixed version. For RHEL-family distros (AlmaLinux, Rocky, RHEL, CloudLinux), compares uname -r against the vendor-published fixed version for that release. Best-effort; verify against your distro tracker.

Verdicts

• OK — KernelCare livepatch applied, running kernel at/after the published fix, or all relevant modules blacklisted.
• MITIGATED — kernel is unpatched but every reach-in module is blacklisted, so the bug can't be triggered. Patch when you can.
• REBOOT NEEDED — patched kernel installed, you're still on the old one.
• VULNERABLE — running kernel verified older than the fix and a kernel upgrade is available, or modules loaded with an upgrade pending.
• WAITING ON VENDOR PATCH — running kernel older than the upstream fix, no kernel upgrade currently available. Common on Rocky/CloudLinux trailing AlmaLinux by a build, or when the distro backports under a different version string.
• AT RISK — KernelCare-managed host without the Dirty Frag livepatch yet, or modules available with an upgrade pending.
• LIKELY PATCHED — modules loaded but the running kernel is at/after the published fix. Script can't introspect a loaded module's patch level; defers to vendor metadata.
• UNKNOWN — no fixed-version table for this distro (Ubuntu, Debian, TuxCare ELS) and no other strong signal. Cross-reference the distro tracker.

Stopgap mitigation

Use this when your distro hasn't shipped a kernel update yet, or when you can't reboot soon and need the reach-in modules unloaded:

If rmmod says "module is in use", something on the box actively uses IPsec or AF_RXRPC (some VPNs, AFS clients, strongSwan, Libreswan). Don't force-unload it. Patch the kernel and reboot instead.

KernelCare / TuxCare ELS users: livepatches for CVE-2026-43284 cover this without a reboot. Check kcarectl --patch-info.

Targets

Aimed at AlmaLinux 8/9/10, Rocky, RHEL, CloudLinux 8/9/10, Ubuntu, Debian, and CentOS 7 (TuxCare ELS / KernelCare). The fixed-version table is RHEL-family-specific; Ubuntu/Debian fall back to package-manager freshness. Confirm any green verdict against your distro's tracker.

Discussion

• AlmaLinux advisory: Dirty Frag
• CloudLinux / KernelCare: mitigation and kernel update
• cPanel: security advisory
• Forum thread: Dirty Frag check script (linuxcommunity.io)
• Companion checker: CVE-2026-31431-check
• Issues: GitHub

License

MIT — see LICENSE.