Linux Kernel Local Privilege Escalation Vulnerability “Dirty Frag” (CVE-2026-43284, CVE-2026-43500)

A few days after the Copy Fail vulnerability, 2 new zero-day high-severity local privilege escalation vulnerabilities (CVE-2026-43284, CVE-2026-43500), collectively known as “Dirty Frag“, have been identified in the Universal Linux kernel, that affects most mainstream Linux distributions, including Red Hat Enterprise Linux (RHEL), Ubuntu, and SUSE, with kernel built since 2017. Successfully exploiting this vulnerability could allow an attacker to achieve root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability. System owners are strongly advised to take immediate mitigation measures for their affected systems to reduce potential risks.

Vulnerability

• Linux Kernel Local Privilege Escalation Vulnerability “Dirty Frag” (CVE-2026-43284, CVE-2026-43500)

Severity Level

• High

Affected Versions

• Most mainstream Linux distributions, including Red Hat Enterprise Linux (RHEL), Ubuntu, and SUSE, with kernel built since 2017.

Remediation

• Workaround: Use the following command to remove the modules in which the vulnerabilities occur and clear the page cache.
  • sh -c “printf ‘install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n’ > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true”
• Apply the patch for each distribution ASAP after it is released.

Reference

• Red Hat: RHSB-2026-003 Networking subsystem Privilege Escalation – Linux Kernel (Dirty Frag) – (CVE-2026-43284)
• Red Hat: CVE-2026-43284, CVE-2026-43500
• Ubuntu: CVE-2026-43284, CVE-2026-43500
• Ubuntu: Dirty Frag Linux kernel local privilege escalation vulnerability mitigations
• Ask Ubuntu: kernel – How do I fix the Dirty Frag LPE vulneraiblity on Ubuntu?
• SUSE: CVE-2026-43284, CVE-2026-43500
• Debian: CVE-2026-43284, CVE-2026-43500
• Dirty Frag (CVE-2026-43284, CVE-2026-43500): Mitigation and Kernel Update on CloudLinux
• NVD: CVE-2026-43284
• Microsoft: Active attack: Dirty Frag Linux vulnerability expands post-compromise risk
• Tenable: Dirty Frag (CVE-2026-43284,CVE-2026-43500): Linux Kernel Privilege Escalation FAQ
• GitHub – V4bel/dirtyfrag · GitHub
• Hacker News: Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
• Linux Kernel Vulnerability “Dirty Frag”
• The CyberSec Guru: Dirty Frag Linux Vulnerability: Universal Root Exploit

Published on: 8 May 2026

Last updated on: 11 May 2026