nihan-silent-reign/cve-2026-43284-dirty-frag-Technical analysis of CVE-2026-43284 (Dirty Frag), a Linux kernel xfrm ESP local privilege escalation enabling page-cache writes to read-only files for root compromise.
Detailed technical analysis of CVE-2026-43284 (Dirty Frag) local privilege escalation flaw in the Linux kernel.
CVE-2026-43284 (commonly referred to as part of the Dirty Frag vulnerability suite) is a critical local privilege escalation (LPE) flaw in the Linux kernel. It stems from a logic flaw within the xfrm ESP (Encapsulating Security Payload) input subsystem. The bug allows a local, unprivileged attacker to bypass typical Copy-on-Write (CoW) protections and achieve an arbitrary page-cache write primitive into read-only system files (such as /usr/bin/su), ultimately leading to a full root compromise.
Vulnerability Breakdown & Attack Vector1.
The Constraint: Interacting with the kernel's IPsec configuration normally requires the CAP_NET_ADMIN capability, a privilege restricted to the normal user. The Bypass: A local unprivileged user can create a separate unprivileged User Namespace and Network Namespace (using flags like CLONE_NEWUSER | CLONE_NEWNET). Inside this isolated unprivileged container space, the attacker becomes the "root" process of that namespace, granting them CAP_NET_ADMIN privileges within that bounded context.
With CAP_NET_ADMIN inside the custom network namespace, the attacker configures a fake Security Association (SA) and IPsec policies.
Using system calls like splice(2) or vmsplice(2), the attacker attaches pages belonging to a target read-only file (e.g., /usr/bin/su) into a socket buffer (skb) fragment.
The Constraint: The attacker must force the kernel to parse the data through the esp_input() routine.
The Strategy: The attacker creates an ESP-in-UDP encapsulation network structure and directs the transmission to the host's loopback interface (127.0.0.1).
When the packet is received locally via the loopback channel, the kernel's networking stack identifies the UDP packet wrapper, decapsulates it, and hands the inner payload off to esp_input() for processing.
Due to a logic bug in the IPv4/IPv6 datagram append paths, the kernel fails to properly mark the underlying socket buffer fragments with the SKBFL_SHARED_FRAG flag when splicing pages into UDP sockets.
Consequently, esp_input() misinterprets the packet as a private, uncloned buffer and takes a "no-COW" performance optimization fast path.
Instead of copying the data to a safe user buffer, esp_input() performs an in-place decryption directly over the memory pages borrowed from the system's page cache
By fine-tuning the encrypted payload data and utilizing the cryptographic algorithm configuration (such as Extended Sequence Numbers), the decryption process deterministically overwrites the targeted binary in the page cache.
Once the page cache of a binary like /usr/bin/su is poisoned in memory with the attacker's payload, executing the binary triggers the execution of the payload as root without ever touching or modifying the binary stored on the actual physical disk.
Impact: High-reliability, deterministic local privilege escalation across major enterprise Linux distributions without risking kernel panics.
Remediation: Update the Linux kernel to versions incorporating the patch that enforces SKBFL_SHARED_FRAG handling for datagram splices and introduces a safe fallback to skb_cow_data() inside the ESP processing logic.
