CVE-2026-43284 — DirtyFrag: Linux Kernel ESP Page-Cache Write LPE¶
Key facts
CVE-2026-43284 is a High (7.8) vulnerability: DirtyFrag: Linux Kernel ESP Page-Cache Write LPE. This entry ships a detection-only PoC.
| CVE | CVE-2026-43284 |
| Severity | High (7.8) |
| Detection / prevention | — |
| PoC | poc.py |
| Source | 2026/CVE-2026-43284/ |
Details¶
Overview¶
| Field | Value |
|---|---|
| CVE ID | CVE-2026-43284 |
| CVSS | 7.8 (HIGH) |
| Type | Local Privilege Escalation |
| Component | Linux Kernel xfrm/ESP (IPsec) |
| Affected | Kernel 4.11 — 6.18.27 |
| Patched | 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28 |
| Exploit | Public PoC (github.com/V4bel/dirtyfrag) |
| Alias | Dirty Frag |
Description¶
MSG_SPLICE_PAGES attaches pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG, but IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. This leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path and decrypts in place over data that is not owned privately by the skb.
An attacker can splice a pipe into a UDP socket configured for ESP encapsulation, send a crafted ESP datagram to loopback, and corrupt cached pages of setuid binaries (e.g., /usr/bin/su) to gain root access.
Chained With¶
- CVE-2026-43500 (RxRPC variant) — Together they form the "Dirty Frag" exploit chain for universal Linux LPE.
Detection¶
Mitigation¶
# Block esp4/esp6/rxrpc kernel modules
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
rmmod esp4 esp6 rxrpc 2>/dev/null
# Disable unprivileged user namespaces (alternative)
sysctl -w kernel.unprivileged_userns_clone=0
References¶
Frequently asked questions¶
What is CVE-2026-43284?¶
CVE-2026-43284 is a High (7.8) vulnerability: DirtyFrag: Linux Kernel ESP Page-Cache Write LPE. This entry ships a detection-only PoC.
How do I detect CVE-2026-43284?¶
Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.
How do I block or mitigate CVE-2026-43284?¶
Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.
For authorized security testing and research only. See the full source and NVD record.