CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Dirty Frag, Linux kernel xfrm-ESP page-cache write primitive, LPE (ITW, PoC public)

cve · CVE-2026-43284

Coverage
1
first 2026-05-09 → last 2026-10-25
Latest activity
2026-09-05
Dirty Frag: two kernel page-cache write flaws give local root; Microsoft saw su escalation that may be it or…
Peak priority
high
1 high
Targets
·
regions: europe, switzerland
Sources cited
10
8 hosts

Action items (1)

Do-now tasks recorded on the entries about CVE-2026-43284, newest first. Check the date before acting on an older one.

  • Apply the distribution kernel update for CVE-2026-43284 and CVE-2026-43500, and confirm the fix for CVE-2026-46300 is installed too.
    2026-05-09CVE-2026-43284 +1

Defender insights

What each entry about CVE-2026-43284 tells a defender to do, newest first.

2026-05-09HIGHDirty Frag: two kernel page-cache write flaws give local root; Microsoft saw su escalation that may be it or Copy Fail

Exposure · detection

Story timeline

  1. 2026-05-09CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released
    trending-vulnerabilitiesDirty Frag: two kernel page-cache write flaws give local root; Microsoft saw su escalation that may be it or Copy Fail

Hunting pivots

Affected products
Linux kernel
Tags
lpepatch-availablepoc-publicvulnerabilities
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×1

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic · ATT&CK page ↗

T1611Escape to Host×1

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic · ATT&CK page ↗

Entries about Dirty Frag, Linux kernel xfrm-ESP page-cache write primitive, LPE (ITW, PoC public) (1)

2026-05-09 · view entry permalink →

HIGHCVE-2026-43284 +1updatedNATOB2

CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released

Researcher Hyunwoo Kim (V4bel) published "Dirty Frag" on 2026-05-07, after the embargo had been broken by external factors and before patches or CVE ids existed (V4bel, 2026-05-07). It is two page-cache write flaws: CVE-2026-43284 in the xfrm-ESP (IPsec) receive path, in the kernel since 2017 and fixed in mainline commit f4c50a4034e6, and CVE-2026-43500 in RxRPC, in the kernel since 2023 and fixed in mainline commit aa54b1d27fe0 (V4bel, 2026-05-07). In both, a page-cache page planted with splice() sits in a fragment of a network buffer and the receiving code decrypts it in place, writing into the cached copy of a file: the ESP variant stores 4 attacker-chosen bytes per trigger into a setuid binary such as su, and the RxRPC variant stores 8 bytes whose value the attacker brute-forces through the session key, aimed at /etc/passwd; the result is deterministic root without a race window (V4bel write-up, 2026-05-07). The ESP variant needs the privilege to create a user namespace, which Ubuntu sometimes blocks through AppArmor; the RxRPC variant needs no namespace but depends on the rxrpc module, which most distributions do not ship and Ubuntu loads by default (V4bel, 2026-05-07). The kernel.org CNA scores CVE-2026-43284 CVSS 8.8, and NVD and CISA score CVE-2026-43500 7.8 (Ubuntu, 2026-05-08). Microsoft reports limited in-the-wild privilege escalation involving su that "may be indicative of techniques associated with either" Dirty Frag or Copy Fail: an SSH session ran an ELF binary that escalated through su, then edited a GLPI LDAP authentication file and deleted and read web session files (Microsoft Security Blog, 2026-05-08). Copy Fail is the earlier CVE-2026-31431 (Microsoft Security Blog, 2026-05-08).

The researcher tested the exploit on Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10 and Fedora 44 (V4bel, 2026-05-07). Ubuntu publishes fixed kernels for every supported release from 18.04 to 26.04 (Ubuntu, 2026-05-08), and Red Hat states that fixes are released for all affected products and that CVE-2026-43500 does not affect Red Hat products (Red Hat RHSB-2026-003). Where a fix cannot be applied, NCSC-CH advises blocking or removing the esp4, esp6 and rxrpc modules (NCSC-CH advisory 12547, 2026-05-08), which affects IPsec and AFS where they are in use (Ubuntu, 2026-05-08); on RHEL, user.max_user_namespaces=0 blocks the ESP path (Red Hat RHSB-2026-003).

Updaterun 2026-05-11-migratedcvesevidenceregionssourcesbody

Microsoft's Defender Security Research Team reported on 2026-05-08 "limited in-the-wild activity where privilege escalation involving ‘su’ is observed, and which may be indicative of techniques associated with either “Dirty Frag” or “Copy Fail”": an external connection gained SSH access, spawned a shell and ran an ELF binary that immediately escalated through su (Microsoft Security Blog, 2026-05-08). Microsoft does not say which flaw the binary used.

Red Hat's bulletin RHSB-2026-003 lists the Dirty Frag CVEs, states that CVE-2026-43500 does not affect Red Hat products, and gives user.max_user_namespaces=0 as a targeted mitigation alongside blocking the ESP modules (Red Hat RHSB-2026-003). NCSC.ch's Security Hub post 12547 of 2026-05-08 noted a public proof of concept and advised temporarily blacklisting esp4, esp6 and rxrpc (NCSC-CH advisory 12547, 2026-05-08), and Belgium's CCB issued a parallel advisory (CCB Belgium, 2026-05-08).

The mainline fixes are f4c50a4034e6 for the ESP flaw and aa54b1d27fe0 for the RxRPC flaw (V4bel, 2026-05-07). Microsoft warns that modifications made before mitigation may persist in cached file content even after the vulnerable modules are disabled (Microsoft Security Blog, 2026-05-08). On Ubuntu systems where AppArmor blocks unprivileged user namespaces, the ESP path cannot be triggered, while the RxRPC path needs no namespace (V4bel, 2026-05-07). Blocking rxrpc breaks AFS and other RxRPC uses, so for those hosts the kernel update is the fix (Ubuntu, 2026-05-08).

Updaterun 2026-09-05T0409Z-intelupdated_atcvesentitiesclassificationtechniquessourcesactionssourcing_notebody

A related flaw, CVE-2026-46300 ("Fragnesia"), reopens this vulnerability's underlying page-cache-write primitive even on hosts already patched against CVE-2026-43284: a bug from 2013 in the code that merges packet fragments drops the marker that flags a fragment as page-cache-backed, which the original xfrm-ESP fix depends on to decide whether it is safe to decrypt in place (Aikido Security). Red Hat's own security bulletin groups all three CVEs under the collective "Dirty Frag" name, notes that the family is similar enough to the earlier Copy Fail flaw to be called "Copy Fail 2", and confirms CVE-2026-46300 affects supported Red Hat Enterprise Linux kernels; administrators who patched only against CVE-2026-43284/CVE-2026-43500 should verify the CVE-2026-46300 fix is applied too (Red Hat RHSB-2026-003). Public proof-of-concept exploits for this family now target Kubernetes specifically, extending the exposure to container-shared-kernel environments beyond the bare-metal/VM case originally described (Aikido Security).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagscvesaffected_productssourcesevidencesourcing_notebodyactions

Microsoft's observation of su-based escalation "may be indicative of techniques associated with either" Dirty Frag or Copy Fail (Microsoft Security Blog, 2026-05-08), so exploitation of these two CVEs is not confirmed. The flaws work by decrypting a splice()-planted page-cache page in place, not through DMA remapping (V4bel write-up, 2026-05-07); mainline fixed the ESP flaw in f4c50a4034e6 and the RxRPC flaw in aa54b1d27fe0, and distribution kernels are available (V4bel, 2026-05-07) (Ubuntu, 2026-05-08). Red Hat says CVE-2026-43500 does not affect its products and gives user.max_user_namespaces=0 as its targeted mitigation (Red Hat RHSB-2026-003). The write modifies the page cache in RAM (V4bel write-up, 2026-05-07) while the file on disk never changes (Aikido Security, 2026-09-04), so a file-write watch does not fire. The ESP variant stores 4 attacker-chosen bytes per trigger into a setuid binary such as su; the RxRPC variant stores 8 bytes whose value the attacker brute-forces through the session key, aimed at /etc/passwd (V4bel write-up, 2026-05-07).

Improvementrun 2026-10-21T1149Z-auditcvessourcessourcing_notebodyheadlinereferences

FIRST's EPSS probability was 0.0262 for CVE-2026-43500 and 0.9419 for CVE-2026-43284 on 2026-10-20 (FIRST.org EPSS API, 2026-10-20); on 2026-09-04 the two scores were 0.9286 and 0.9324 (FIRST.org EPSS API, 2026-09-04). Microsoft's report of 2026-05-08 is by its Defender Security Research Team (Microsoft Security Blog, 2026-05-08).

Builds on: Copy Fail turns an unprivileged Linux shell into root with one portable script; CISA lists it…

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: V4bel (Hyunwoo Kim) · V4bel write-up · Microsoft Security Blog · NCSC-CH advisory 12547 · Red Hat RHSB-2026-003 · Ubuntu · CCB Belgium · Aikido Security · FIRST.org EPSS API

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns1

Source distribution

  • api.first.org2 (20%)
  • github.com2 (20%)
  • access.redhat.com1 (10%)
  • aikido.dev1 (10%)
  • ccb.belgium.be1 (10%)
  • microsoft.com1 (10%)
  • security-hub.ncsc.admin.ch1 (10%)
  • ubuntu.com1 (10%)

External references

NVD · cve.org · CISA KEV

All cited sources (10)