CVE-2026-43284 (Dirty Frag) – Linux Kernel Vulnerability Research

Overview

This repository documents a complete defensive security research project focused on CVE-2026-43284 (Dirty Frag), a Linux kernel vulnerability affecting the XFRM/IPsec networking subsystem.

The goal of this project is not to weaponize the vulnerability, but to understand how it works, reproduce it safely in a controlled laboratory, analyze the Linux kernel source code, study the security patch, and build practical detection and incident response techniques that can be used by security professionals.

The project combines Linux kernel research, networking, SOC operations, Detection Engineering, and Incident Response into a single practical portfolio.

Project Objectives

This project was created to:

• Understand the Linux networking subsystem.
• Learn Linux kernel internals.
• Study packet processing inside the kernel.
• Analyze the root cause of Dirty Frag.
• Compare vulnerable and patched source code.
• Build a safe reproducible research laboratory.
• Develop detection rules using auditd, Splunk and Wazuh.
• Perform threat hunting.
• Practice incident response.
• Map attacker behaviors to MITRE ATT&CK.
• Produce documentation useful for VAPT, SOC, DFIR and Linux administrators.

About CVE-2026-43284

Dirty Frag is a Linux kernel vulnerability located within the XFRM/IPsec networking subsystem.

Rather than simply reproducing a Proof of Concept (PoC), this repository focuses on understanding:

• Why the vulnerability exists.
• Which kernel components are involved.
• How packets move through the networking stack.
• Why Copy-on-Write protection failed.
• How the Linux developers fixed the issue.
• How defenders can detect suspicious activity.
• How incident responders should investigate affected systems.

Skills Demonstrated

This project demonstrates practical experience in:

• Linux Administration
• Linux Kernel Research
• Source Code Analysis
• Git and Patch Analysis
• Networking
• IPsec / XFRM
• Docker
• Detection Engineering
• SIEM
• Splunk
• Wazuh
• auditd
• Threat Hunting
• Incident Response
• MITRE ATT&CK
• Technical Documentation

Repository Structure

.
├── README.md
│
├── Lab
│   ├── 01-Environment.md
│   ├── 02-Docker-Setup.md
│   ├── 03-Recon-Scanning.md
│   ├── 04-Exploitation.md
│   ├── 05-Network-Configuration.md
│   ├── 06-Attacker-Does.md
│
├── Research
│   ├── 01-Kernel-Version.md
│   ├── 02-Source-Code-Notes.md
|   └── 03.Detection-Engineering.md
│
│
└── references

Learning Roadmap

The documentation is designed to be read in the following order.

Phase 1 – Build the Lab

Learn how to prepare a Linux research environment using Docker and configure a reproducible laboratory.

Topics include:

• Environment preparation
• Docker
• Networking
• Kernel source
• Kernel compilation

Phase 2 – Research

Study the Linux kernel itself.

Topics include:

• Kernel version analysis
• Linux source tree
• XFRM subsystem
• sk_buff
• Copy-on-Write
• Source code analysis
• Patch comparison

Phase 3 – Detection Engineering

Learn how defenders detect suspicious activity surrounding Dirty Frag.

Topics include:

• auditd
• Splunk
• Wazuh
• Linux Audit Framework
• SIEM correlation
• Detection rules
• Investigation workflows

Phase 4 – Threat Hunting

Perform proactive searches for indicators of compromise.

Topics include:

• Log correlation
• Process execution
• Kernel module activity
• Authentication events
• File integrity
• Network activity

Lab Environment

The research was performed in an isolated laboratory environment.

Example components include:

• Kali Linux (Research Workstation)
• Ubuntu Linux
• Docker
• Linux Kernel Source
• Git
• Python
• auditd
• Splunk
• Wazuh

No production systems were used during this research.

Tools Used

Intended Audience

This repository is intended for:

• SOC Analysts
• Detection Engineers
• Threat Hunters
• Incident Responders
• Linux Administrators
• Security Researchers
• VAPT Engineers
• Students learning Linux security

What This Repository Does NOT Cover

This project focuses on defensive security research.

It does not provide:

• Offensive exploitation guides
• Malicious payloads
• Weaponized Proof of Concepts
• Instructions for attacking production systems

The objective is to improve understanding of Linux kernel security and strengthen defensive capabilities.

References

• Linux Kernel Documentation
• Linux XFRM Documentation
• MITRE ATT&CK
• Vendor Security Advisories
• Official CVE Record

License

This project is released under the MIT License.

Acknowledgements

Thanks to:

• Linux Kernel Developers
• Security researchers who responsibly disclosed the vulnerability
• Open-source security community