xd20111/cve-2026-43284Deterministic Linux kernel local privilege escalation exploit chaining two page-cache write primitives (xfrm/ESP and RxRPC) for reliable root access on all major distributions since 2017.
Universal Linux Kernel Local Privilege Escalation
| Field | Detail |
|---|---|
| CVE | CVE-2026-43284 (xfrm/ESP) + CVE-2026-43500 (RxRPC) |
| Nickname | Dirty Frag |
| CVSS | 7.8 HIGH |
| Type | Local Privilege Escalation (LPE) |
| Introduced | Linux kernel 4.10 (2017, commit cac2661c53f3) |
| Fixed | Mainline commits f4c50a4034e6 / aa54b1d27fe0 |
| Requires | Local unprivileged shell access |
| Remote vector | None — local only |
| Disclosed | May 7, 2026 by Hyunwoo Kim (@v4bel) |
A logic flaw in the Linux kernel's xfrm/ESP and RxRPC subsystems allows an unprivileged local user to perform a deterministic, controlled arbitrary write into the page cache of any readable file on the system — including setuid binaries such as /usr/bin/su.
The root cause is unsafe in-place decryption of shared socket buffer (skb) fragments that reference page cache pages, particularly when using splice(2) or sendfile(2). This provides a powerful arbitrary page cache write primitive, which can be leveraged to overwrite sensitive files in memory and achieve full root access.
Two distinct primitives are chained to achieve universal coverage:
xfrm-ESP Page-Cache Write: shares the same sink as Copy Fail but is triggered via the esp4/esp6 modules, regardless of whether algif_aead is available. Requires namespace creation privileges.RxRPC Page-Cache Write: does not require namespace privileges, but rxrpc.ko must be present (loaded by default on Ubuntu). Covers the blind spots of CVE-2026-43284.Chaining the two variants makes them cover each other's blind spots, achieving reliable root on every major distribution.
No race condition. No retries. No crash risk. Deterministic across all tested distributions.
Important: Even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, Dirty Frag remains exploitable via CVE-2026-43284.
| Dirty Cow (2016) | Dirty Pipe (2022) | Copy Fail (2026) | Dirty Frag (2026) | |
|---|---|---|---|---|
| Race condition required | Yes | Partial | No | No |
| Version-specific | Yes | Yes | No | No |
| Reliability | Flaky | Moderate | Deterministic | Deterministic |
| Distro coverage | Limited | Limited | All since 2017 | All since 2017 |
| Bypasses Copy Fail mitigation | — | — | N/A | Yes |
algif_aead blacklist (Copy Fail workaround) entirelyCVE-2026-43284 (xfrm/ESP): Linux kernel from commit cac2661c53f3 (2017-01-17) through f4c50a4034e6 (2026-05-05).
CVE-2026-43500 (RxRPC): Linux kernel from commit 2dc334f1a63a (2023-06-08) through aa54b1d27fe0 (2026-05-10).
The effective lifetime of the vulnerability chain is approximately 9 years.
All major distributions shipping kernels in this range are affected, including:
| Distribution | Tested Version | Status |
|---|---|---|
| Ubuntu 24.04.4 | 6.17.0-23-generic | Affected — patch rolling out |
| RHEL 10.1 | 6.12.0-124.49.1.el10_1.x86_64 | Affected — patch rolling out |
| AlmaLinux 10 | 6.12.0-124.52.3.el10_1.x86_64 | Affected — patch available |
| CentOS Stream 10 | 6.12.0-224.el10.x86_64 | Affected — patch rolling out |
| Fedora 44 | 6.19.14-300.fc44.x86_64 | Affected — patch available |
| openSUSE Tumbleweed | 7.0.2-1-default | Affected — in progress |
| Debian | — | Affected — in progress |
gcc -O0 -Wall -o exp exp.c -lutil && ./exp
Do not use on systems you are not authorized to test.
⚠️ Important: After running this exploit, the page cache is contaminated. To clear the polluted page cache and ensure system stability, run:
echo 3 > /proc/sys/vm/drop_caches
or reboot the system.
Update to a kernel containing the mainline fixes and reboot.
Fixed in mainline via:
f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y && sudo reboot
# RHEL / AlmaLinux / CentOS Stream
sudo dnf clean metadata && sudo dnf upgrade && sudo reboot
# SUSE / openSUSE
sudo zypper refresh && sudo zypper update kernel-default && sudo reboot
# Fedora
sudo dnf upgrade --refresh && sudo reboot
If patching immediately is not possible, disable the vulnerable modules and clear the page cache.
# Blacklist vulnerable modules
sudo sh -c 'printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /etc/modprobe.d/dirtyfrag.conf'
# Unload modules immediately
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true
# Drop page cache
echo 3 | sudo tee /proc/sys/vm/drop_caches >/dev/null
| Component | Impact |
|---|---|
| SSH | ✅ Not affected |
| dm-crypt / LUKS | ✅ Not affected |
| kTLS / in-kernel TLS | ✅ Not affected |
| OpenSSL / GnuTLS / NSS (default builds) | ✅ Not affected |
| IPsec / XFRM (ESP tunnels, VPNs) | ⚠️ Breaks — esp4 and esp6 will be unavailable |
| AFS / OpenAFS clients using RxRPC | ⚠️ Breaks — rxrpc will be unavailable |
Applications using AF_ALG + AEAD directly | ⚠️ Check with lsof | grep AF_ALG |
For untrusted workloads — containers, CI runners, sandboxed environments — restrict AF_ALG socket creation and splice() via seccomp or AppArmor policy regardless of patch state. This limits the attack surface even on vulnerable kernels but is not a complete fix.
Check if vulnerable modules are currently loaded or in use:
# Check if modules are loaded
lsmod | grep -E 'esp4|esp6|rxrpc'
# Check if any process has an AF_ALG socket open
lsof | grep AF_ALG
ss -xa | grep alg
# Confirm workaround is active after reboot
cat /etc/modprobe.d/dirtyfrag.conf
| Resource | Link |
|---|---|
| CVE-2026-43284 Mainline Fix | f4c50a4034e6 |
| CVE-2026-43500 Mainline Fix | aa54b1d27fe0 |
| NVD — CVE-2026-43284 | https://nvd.nist.gov/vuln/detail/CVE-2026-43284 |
| NVD — CVE-2026-43500 | https://nvd.nist.gov/vuln/detail/CVE-2026-43500 |
| Date | Event |
|---|---|
| 2017-01-17 | CVE-2026-43284 regression introduced (cac2661c53f3) |
| 2023-06-08 | CVE-2026-43500 regression introduced (2dc334f1a63a) |
| 2026-05-05 | CVE-2026-43284 patched in mainline (f4c50a4034e6) |
| 2026-05-07 | Public disclosure |
| 2026-05-10 | CVE-2026-43500 patched in mainline (aa54b1d27fe0) |
| 2026-05-10+ | Distribution patches begin shipping |
Why chain two vulnerabilities?