Dirty Frag security flaw

English Applications
1

Fyi there is a new problem in the linux kernel similar to Copy Fail that was fixed a few days ago. Unfortunately there is again an exploit published

The current 16.0 kernel 6.12.0-160000.29-default and the current Tumbleweed kernel 7.0.3-1-default are affected. For mitigation create a file /etc/modprobe.d/10-dirtyfrag.conf with content

blacklist esp4
install esp4 /bin/false
blacklist esp6
install esp6 /bin/false
blacklist rxrpc
install rxrpc /bin/false

and then unload these modules or reboot. Please be aware that this mitigation will break IPSEC VPN that use the ESP protocol. There is no CVE number as fa as i know for this.

1 Like
2

CVE-2026-43284
https://bugzilla.opensuse.org/show_bug.cgi?id=1264449

3 Likes
3

@rawar:

<https://www.suse.com/security/cve/CVE-2026-43284.html>

3 Likes
4

Both vulnerabilities:

Bug 1264449 (CVE-2026-43284) - VUL-0: CVE-2026-43284: kernel: xfrm: esp: avoid in-place decrypt on shared skb frags

Bug 1264450 (CVE-2026-43500) - VUL-0: CVE-2026-43500: kernel: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present

From https://github.com/V4bel/dirtyfrag

Note

2026-05-08 Update:

  • The xfrm-ESP Page-Cache Write vulnerability has been assigned CVE-2026-43284 and patched in mainline at f4c50a4034e6.
  • The RxRPC Page-Cache Write vulnerability has been reserved as CVE-2026-43500 for tracking; no patch exists in any tree yet.

Pages from SUSE:

https://support.scc.suse.com/s/kb/Security-Vulnerability-Copy-Fail2-aka-DirtyFrag?language=en_US

Additions:

https://github.com/V4bel/dirtyfrag
This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel), which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.

Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.

For detailed technical information and the timeline, see here.

Because the embargo has currently been broken, no patch or CVE exists. After consultation with the maintainers on linux-distros@vs.openwall.org and at their request, this Dirty Frag document is being published. For the disclosure timeline, refer to the technical details.

Note

2026-05-08 Update:

The xfrm-ESP Page-Cache Write vulnerability has been assigned CVE-2026-43284 and patched in mainline at f4c50a4034e6.
The RxRPC Page-Cache Write vulnerability has been reserved as CVE-2026-43500 for tracking; no patch exists in any tree yet.

=============================================================
Also:
https://nvd.nist.gov/vuln/detail/CVE-2026-43284
https://app.opencve.io/cve/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43284
https://ubuntu.com/security/CVE-2026-43500
https://security-tracker.debian.org/tracker/CVE-2026-43500
https://itcc.uni-koeln.de/en/services/information-security/it-security/vulnerability-cve-2026-43284-dirty-frag
https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/

Fixes:
https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available

https://blog.cloudlinux.com/dirty-frag-mitigation-and-kernel-update
Dirty Frag (CVE-2026-43284, CVE-2026-43500): Mitigation and Kernel Update on CloudLinux

A week after Copy Fail (CVE-2026-31431), researcher Hyunwoo Kim disclosed a second Linux kernel local privilege escalation in the same broad area — IPsec ESP and rxrpc — and named it Dirty Frag. A working public proof-of-concept exists; any unprivileged local user can use it to gain root in a single command.

1 Like
5

I have a question for my personal peace of mind:

That vulnerability can just be exploited when logged in to my system as a local user, right? Meaning physical access and/or ssh access is needed if I understand it correctly!?

6

Shell access, however that may be…

2 Likes
7

You may have services/apps running as an unprivileged user. Use sudo cat /etc/passwd to see. If some apps go rogue they now can become root and own your machine.

8

This is fixed now for Leap 16.0 with kernel 6.12.0-160000.30.1. The rxrpc module and the related AFS filesystem has been removed from the kernel config.

2 Likes
9

This topic was automatically closed 7 days after the last reply. New replies are no longer allowed.