CVE-2026-43500 — DirtyFrag: Linux Kernel RxRPC Page-Cache Write LPE¶
Key facts
CVE-2026-43500 is a High (7.8) vulnerability: DirtyFrag: Linux Kernel RxRPC Page-Cache Write LPE. This entry ships a detection-only PoC.
| CVE | CVE-2026-43500 |
| Severity | High (7.8) |
| Detection / prevention | — |
| PoC | poc.py |
| Source | 2026/CVE-2026-43500/ |
Details¶
Overview¶
| Field | Value |
|---|---|
| CVE ID | CVE-2026-43500 |
| CVSS | 7.8 (HIGH) |
| Type | Local Privilege Escalation |
| Component | Linux Kernel RxRPC |
| Affected | Kernel 4.11 — 6.18.27 |
| Patched | 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28 |
| Exploit | Public PoC (chained with CVE-2026-43284) |
| Alias | Dirty Frag |
Description¶
The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() in RxRPC do not properly handle packets that are not cloned but carry externally-owned paged fragments. These packets fall through to an in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec().
When chained with CVE-2026-43284, this provides a local privilege escalation path allowing unprivileged users to gain root access.
Chained With¶
- CVE-2026-43284 (ESP variant) — Together they form the "Dirty Frag" exploit chain.
Detection¶
Mitigation¶
# Block esp4/esp6/rxrpc kernel modules
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
rmmod esp4 esp6 rxrpc 2>/dev/null
# Disable unprivileged user namespaces (alternative)
sysctl -w kernel.unprivileged_userns_clone=0
References¶
Frequently asked questions¶
What is CVE-2026-43500?¶
CVE-2026-43500 is a High (7.8) vulnerability: DirtyFrag: Linux Kernel RxRPC Page-Cache Write LPE. This entry ships a detection-only PoC.
How do I detect CVE-2026-43500?¶
Run the detection-only PoC included with this entry against your Docker test lab to confirm whether a target is affected; pair it with your own IDS logging.
How do I block or mitigate CVE-2026-43500?¶
Upgrade to a fixed version per the vendor advisory; the NVD record lists the affected versions. Use the included PoC to verify your remediation.
For authorized security testing and research only. See the full source and NVD record.