CVE-2026-43284 / CVE-2026-43500, Linux "Dirty Frag": deterministic LPE chain via page-cache write primitives in xfrm-ESP and RxRPC, active exploitation confirmed

Microsoft Threat Intelligence published Active attack: Dirty Frag Linux vulnerability expands post-compromise risk on 2026-05-08 reporting "limited in-the-wild activity where privilege escalation involving su is observed." The attack chain observed: SSH initial access → shell spawn → execution of an ELF binary that triggers the LPE primitive in either CVE-2026-43284 (xfrm-ESP page-cache write) or CVE-2026-43500 (RxRPC page-cache write). This is the first formal "exploited in the wild" attribution since the V4bel write-up published on 2026-05-07.

Red Hat published RHSB-2026-003 covering both CVEs on 2026-05-07 and updated it on 2026-05-09, with backported errata rolling out to RHEL 8/9/10 and OpenShift 4 (Red Hat RHSB-2026-003). NCSC.ch issued Security Hub post 12547 on 2026-05-08 noting "Proof of Concept Available" and advising temporary blacklisting of the esp4, esp6 and rxrpc kernel modules pending distribution backports. Belgium's CCB issued a parallel advisory (CCB Belgium, 2026-05-08).

The upstream xfrm-ESP fix merged on 2026-05-07 (kernel commit referenced by V4bel and corroborated by Red Hat); the RxRPC fix was still pending in the netdev tree at time of writing. AlmaLinux backported kernels on 2026-05-08; Ubuntu noted fixes will arrive via the kernel image package. Defender hunt focus: outbound SSH-to-unprivileged-shell-to-ELF-execution chains immediately followed by setuid(0) or su invocations, plus suspicious setsockopt(AF_ALG) patterns on the esp4/esp6/rxrpc modules followed by splice() syscalls into the page cache of read-only files. The Microsoft post emphasises that the page-cache write primitive bypasses on-disk file integrity monitoring (AIDE / IMA-EVM / auditd watch rules); post-incident forensics must compare in-memory page contents against on-disk checksums, not just md5sum of the file.

Mitigation note (carried from 2026-05-09): on Ubuntu where unprivileged user namespaces are blocked by default, the esp4/esp6 path is harder to reach because CAP_NET_ADMIN is required, but the RxRPC path remains exploitable without user-namespaces; the two CVEs are designed to complement each other. Where IPsec is in use, Red Hat suggests kernel.unprivileged_userns_clone=0 (sysctl) as a less disruptive mitigation than full esp4/esp6 module blacklisting. AFS users cannot blacklist rxrpc without losing AFS, wait for the distribution backport.

A related flaw, CVE-2026-46300 ("Fragnesia", tracked in its own entry), reopens this vulnerability's underlying page-cache-write primitive even on hosts already patched against CVE-2026-43284: a thirteen-year-old bug (dating to 2013) in the kernel's skb_try_coalesce() fails to preserve the marker that flags a fragment as page-cache-backed, which the original xfrm-ESP fix depends on to decide whether it is safe to decrypt in place (Aikido Security). Red Hat's own security bulletin groups all three CVEs under the collective "Dirty Frag" name (noting the family's similarity to the earlier CVE-2026-31431 "Copy Fail" is close enough that Red Hat also refers to it as "Copy Fail 2", even though the two remain distinct CVEs with their own code paths) and confirms CVE-2026-46300 affects supported Red Hat Enterprise Linux kernels; administrators who patched only against CVE-2026-43284/CVE-2026-43500 should verify the CVE-2026-46300 fix is applied too (Red Hat RHSB-2026-003). Public proof-of-concept exploits for this family now target Kubernetes specifically, extending the exposure to container-shared-kernel environments beyond the bare-metal/VM case originally described (Aikido Security).