Overview

Vulnerability Summary

A logic flaw in the Linux kernel's xfrm/ESP and RxRPC subsystems allows an unprivileged local user to perform a deterministic, controlled arbitrary write into the page cache of any readable file on the system — including setuid binaries such as /usr/bin/su.

The root cause is unsafe in-place decryption of shared socket buffer (skb) fragments that reference page cache pages, particularly when using splice(2) or sendfile(2). This provides a powerful arbitrary page cache write primitive, which can be leveraged to overwrite sensitive files in memory and achieve full root access.

Two distinct primitives are chained to achieve universal coverage:

• CVE-2026-43284 — xfrm-ESP Page-Cache Write: shares the same sink as Copy Fail but is triggered via the esp4/esp6 modules, regardless of whether algif_aead is available. Requires namespace creation privileges.
• CVE-2026-43500 — RxRPC Page-Cache Write: does not require namespace privileges, but rxrpc.ko must be present (loaded by default on Ubuntu). Covers the blind spots of CVE-2026-43284.

Chaining the two variants makes them cover each other's blind spots, achieving reliable root on every major distribution.

No race condition. No retries. No crash risk. Deterministic across all tested distributions.

Important: Even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, Dirty Frag remains exploitable via CVE-2026-43284.

Comparison to Prior Art

Impact

• Unprivileged local attacker → root shell
• Affects virtually all major Linux distributions shipping kernels since 2017
• Highly reliable with no race conditions required
• Bypasses algif_aead blacklist (Copy Fail workaround) entirely
• Kernel does not panic on failed exploit attempts

Affected Versions

CVE-2026-43284 (xfrm/ESP): Linux kernel from commit cac2661c53f3 (2017-01-17) through f4c50a4034e6 (2026-05-05).

CVE-2026-43500 (RxRPC): Linux kernel from commit 2dc334f1a63a (2023-06-08) through aa54b1d27fe0 (2026-05-10).

The effective lifetime of the vulnerability chain is approximately 9 years.

All major distributions shipping kernels in this range are affected, including:

Exploitation

Building & Running

gcc -O0 -Wall -o exp exp.c -lutil && ./exp

Do not use on systems you are not authorized to test.

Cleanup

⚠️ Important: After running this exploit, the page cache is contaminated. To clear the polluted page cache and ensure system stability, run:

echo 3 > /proc/sys/vm/drop_caches

or reboot the system.

Mitigation

Option 1 — Patch (Recommended)

Update to a kernel containing the mainline fixes and reboot.

Fixed in mainline via:

• CVE-2026-43284: commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
• CVE-2026-43500: commit aa54b1d27fe0c2b78e664a34fd0fdf7cd1960d71

# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y && sudo reboot

# RHEL / AlmaLinux / CentOS Stream
sudo dnf clean metadata && sudo dnf upgrade && sudo reboot

# SUSE / openSUSE
sudo zypper refresh && sudo zypper update kernel-default && sudo reboot

# Fedora
sudo dnf upgrade --refresh && sudo reboot

Option 2 — Blacklist Vulnerable Modules (Temporary)

If patching immediately is not possible, disable the vulnerable modules and clear the page cache.

# Blacklist vulnerable modules
sudo sh -c 'printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /etc/modprobe.d/dirtyfrag.conf'

# Unload modules immediately
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true

# Drop page cache
echo 3 | sudo tee /proc/sys/vm/drop_caches >/dev/null

What This Workaround Affects

Option 3 — seccomp / AppArmor (Defense-in-Depth)

For untrusted workloads — containers, CI runners, sandboxed environments — restrict AF_ALG socket creation and splice() via seccomp or AppArmor policy regardless of patch state. This limits the attack surface even on vulnerable kernels but is not a complete fix.

Detection

Check if vulnerable modules are currently loaded or in use:

# Check if modules are loaded
lsmod | grep -E 'esp4|esp6|rxrpc'

# Check if any process has an AF_ALG socket open
lsof | grep AF_ALG
ss -xa | grep alg

# Confirm workaround is active after reboot
cat /etc/modprobe.d/dirtyfrag.conf

References

Disclosure Timeline

FAQ

Why chain two vulnerabilities?

xfrm-ESP Page-Cache Write provides a powerful arbitrary 4-byte STORE primitive and is present on most distributions, but requires namespace creation privileges — which Ubuntu sometimes blocks via AppArmor. RxRPC Page-Cache Write does not require namespace privileges, but rxrpc.ko is not included in most distributions — except Ubuntu, where it is loaded by default. Chaining the two makes their blind spots cover each other, achieving reliable root on every major distribution.

What is the relationship with Copy Fail (CVE-2026-31431)?

The xfrm-ESP primitive shares the same page cache write sink as CVE-2026-31431, but is triggered via the esp4/esp6 modules independently of algif_aead. Applying the CVE-2026-31431 mitigation (blacklisting algif_aead) does not protect against Dirty Frag.

Why the "Dirty Frag" name?

The vulnerability dirties the frag member of struct sk_buff, placing it in the same bug class as Dirty Pipe — logic flaws that allow unprivileged writes into the page cache.

Disclaimer

This repository is intended for educational and defensive security purposes only. Do not use any information or code from this repository on systems you do not own or have explicit written authorization to test.