Dirty Frag / Fragnesia

Microsoft Threat Intelligence published Active attack: Dirty Frag Linux vulnerability expands post-compromise risk on 2026-05-08 reporting "limited in-the-wild activity where privilege escalation involving su is observed." The attack chain observed: SSH initial access → shell spawn → execution of an ELF binary that triggers the LPE primitive in either CVE-2026-43284 (xfrm-ESP page-cache write) or CVE-2026-43500 (RxRPC page-cache write). This is the first formal "exploited in the wild" attribution since the V4bel write-up published on 2026-05-07.

Red Hat published RHSB-2026-003 covering both CVEs on 2026-05-07 and updated it on 2026-05-09, with backported errata rolling out to RHEL 8/9/10 and OpenShift 4 (Red Hat RHSB-2026-003). NCSC.ch issued Security Hub post 12547 on 2026-05-08 noting "Proof of Concept Available" and advising temporary blacklisting of the esp4, esp6 and rxrpc kernel modules pending distribution backports. Belgium's CCB issued a parallel advisory (CCB Belgium, 2026-05-08).

The upstream xfrm-ESP fix merged on 2026-05-07 (kernel commit referenced by V4bel and corroborated by Red Hat); the RxRPC fix was still pending in the netdev tree at time of writing. AlmaLinux backported kernels on 2026-05-08; Ubuntu noted fixes will arrive via the kernel image package. Defender hunt focus: outbound SSH-to-unprivileged-shell-to-ELF-execution chains immediately followed by setuid(0) or su invocations, plus suspicious setsockopt(AF_ALG) patterns on the esp4/esp6/rxrpc modules followed by splice() syscalls into the page cache of read-only files. The Microsoft post emphasises that the page-cache write primitive bypasses on-disk file integrity monitoring (AIDE / IMA-EVM / auditd watch rules); post-incident forensics must compare in-memory page contents against on-disk checksums, not just md5sum of the file.

Mitigation note (carried from 2026-05-09): on Ubuntu where unprivileged user namespaces are blocked by default, the esp4/esp6 path is harder to reach because CAP_NET_ADMIN is required, but the RxRPC path remains exploitable without user-namespaces; the two CVEs are designed to complement each other. Where IPsec is in use, Red Hat suggests kernel.unprivileged_userns_clone=0 (sysctl) as a less disruptive mitigation than full esp4/esp6 module blacklisting. AFS users cannot blacklist rxrpc without losing AFS, wait for the distribution backport.

A related flaw, CVE-2026-46300 ("Fragnesia", tracked in its own entry), reopens this vulnerability's underlying page-cache-write primitive even on hosts already patched against CVE-2026-43284: a thirteen-year-old bug (dating to 2013) in the kernel's skb_try_coalesce() fails to preserve the marker that flags a fragment as page-cache-backed, which the original xfrm-ESP fix depends on to decide whether it is safe to decrypt in place (Aikido Security). Red Hat's own security bulletin groups all three CVEs under the collective "Dirty Frag" name (noting the family's similarity to the earlier CVE-2026-31431 "Copy Fail" is close enough that Red Hat also refers to it as "Copy Fail 2", even though the two remain distinct CVEs with their own code paths) and confirms CVE-2026-46300 affects supported Red Hat Enterprise Linux kernels; administrators who patched only against CVE-2026-43284/CVE-2026-43500 should verify the CVE-2026-46300 fix is applied too (Red Hat RHSB-2026-003). Public proof-of-concept exploits for this family now target Kubernetes specifically, extending the exposure to container-shared-kernel environments beyond the bare-metal/VM case originally described (Aikido Security).

Red Hat rates CVE-2026-46300 CVSS 7.8 (Red Hat Product Security, 2026-05-13). Red Hat's own security bulletin groups it under the collective "Dirty Frag" name alongside CVE-2026-43284 and CVE-2026-43500, labelling it specifically "Fragnesia (skb coalescing via ESP-in-TCP)": "three vulnerabilities, collectively known as 'Dirty Frag', have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products" (Red Hat RHSB-2026-003, 2026-07-03). Applicability splits per CVE: "Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them" (Aikido Security, 2026-09-04). Any RHEL, OpenShift or RHEL CoreOS estate must therefore confirm the CVE-2026-46300 fix specifically, not only the earlier two. Exploitation now extends to a container-relevant proof-of-concept: "researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape" (Aikido Security, 2026-09-04). Because containers share the host kernel, a compromised workload that can reach the vulnerable code path (governed by seccomp, pod security and user-namespace settings) can escalate to root on the node (Aikido Security, 2026-09-04). No source states confirmed in-the-wild exploitation of this specific CVE. Microsoft's previously reported limited in-the-wild activity ("privilege escalation involving 'su'") was itself stated as ambiguous between the "Dirty Frag" family and the separate, earlier "Copy Fail" vulnerability (CVE-2026-31431) (Microsoft Security Blog, 2026-05-08). That is not a distinction between the two Dirty Frag CVEs themselves, and not specific evidence of exploitation for CVE-2026-46300.