Security advisory · CVE-2026-43284 · CVE-2026-43500

DIRTY FRAG

Severity · CriticalCVSS · 9.1 / 9.6Linux 6.6 – 6.12

Published 2026-05-08 · updated 2026-10-24

A Linux kernel local privilege escalation chain that writes attacker-controlled bytes into the page cache of suid binaries and /etc/passwd via splice(). Two variants — one in xfrm-ESP, one in RxRPC. The RxRPC variant has no upstream patch and only requires a local user.

No filesystem write occurs — corruption lives only in the page cache, but every subsequent read sees it until the cache is flushed.

Check your hosts What happened

Impact: Local privilege escalation to root
Affected: Linux 6.6 – 6.12 with esp4, esp6 or rxrpc
CVE-2026-43284: xfrm-ESP · patched in f4c50a4034e6
CVE-2026-43500: RxRPC · unpatched upstream
Needs: A local user; the ESP variant also needs user namespaces

[01]

The two variants

CVE-2026-43284

xfrm-ESP (IPsec)

4-byte write per SA via ESN seq_hi. Needs user namespaces. Patched in f4c50a4034e6.

CVE-2026-43500

RxRPC (AFS)

8-byte write per trigger via pcbc(fcrypt) decrypt. Unpatched upstream.

[A]Indicators of compromise

/etc/passwd root entry with empty password (root::) in the page cache.
Shellcode signature 31 ff 31 f6 31 c0 b0 6a in /usr/bin/su page cache.
XFRM SAs with sequential SPI pattern 0xDEADBE1x.
RxRPC keys in process keyrings on hosts that don't run AFS.

[B]Mitigations

Blocklist esp4 / esp6 if you don't use IPsec.
Blocklist rxrpc if you don't use AFS.
sysctl -w kernel.unprivileged_userns_clone=0 to break the ESP variant's prerequisite.

[02]

Check and fix with Swamp

01
Step 1:Am I affected?
A host is likely affected if any of these is true.
- Linux kernel 6.6 through 6.12 without the CVE-2026-43284 backport.
- esp4, esp6, or rxrpc modules are loaded, available, or built into the kernel.
- kernel.unprivileged_userns_clone = 1 (default on Ubuntu / Debian / Fedora).
- Untrusted local users — multi-tenant servers, shared CI runners, container hosts.
Step 2:Install Swamp and the scanner
The @swamp/cve/dirtyfrag extension scans a host and emits a structured report. Its scanFleet method takes a list of IPs and gives you a per-machine patch report across your whole fleet.
Install Swamp:
$ curl -fsSL https://swamp-club.com/install.sh | sh
Initialize a new repo (run this in a new empty directory):
$ swamp repo init
Pull the scanner:
$ swamp extension pull @swamp/cve/dirtyfrag
Create a scanner for this machine:
$ swamp behavior create @swamp/cve/dirtyfrag dirtyfrag-scanner
Am I vulnerable:
$ swamp behavior run dirtyfrag-scanner scan
Mitigate (a dry run until you pass --input dryRun=false):
$ swamp behavior run dirtyfrag-scanner mitigate

Step 3:Run across your fleet

Create a fleet scanner with your SSH user and key as global arguments, then pass a comma-separated list of hosts and scanFleet runs the scan against each one in parallel. A host that needs a different login takes it as user@host; plain entries use sshUser, and every host uses sshKey. Only hosts and dryRun are passed with --input.

swamp behavior create @swamp/cve/dirtyfrag dirtyfrag-fleet \
    --global-arg sshUser=ubuntu \
    --global-arg sshKey=~/.ssh/dirtyfrag-fleet.pem

swamp behavior run dirtyfrag-fleet scanFleet \
    --input hosts=34.204.74.133,admin@3.94.251.138

›Scan results

# Dirty Frag Scan Results

2 hosts scanned: 2 vulnerable, 0 clean

┌─────────────────┬────────────────┬──────────┬─────────────┬───────────────┬──────────┬────────────┐
│ Host            │ Kernel         │ Risk     │ ESP (43284) │ RxRPC (43500) │ IOCs     │ Status     │
├─────────────────┼────────────────┼──────────┼─────────────┼───────────────┼──────────┼────────────┤
│ ip-172-31-35-99 │ 7.0.0-1004-aws │ CRITICAL │ Vulnerable  │ Vulnerable    │ XFRM SAs │ VULNERABLE │
├─────────────────┼────────────────┼──────────┼─────────────┼───────────────┼──────────┼────────────┤
│ ip-172-31-45-27 │ 7.0.0-1004-aws │ CRITICAL │ Vulnerable  │ Vulnerable    │ XFRM SAs │ VULNERABLE │
└─────────────────┴────────────────┴──────────┴─────────────┴───────────────┴──────────┴────────────┘

Step 4:Mitigate across your fleet

mitigate re-scans each host, then on the vulnerable ones writes a modprobe blocklist for esp4/ esp6/ rxrpc, unloads them from the running kernel, and flushes the page cache. Clean hosts are skipped automatically.

dryRun defaults to true — the method prints the commands it would run and changes nothing. Pass dryRun=false to actually apply.

swamp behavior run dirtyfrag-fleet mitigate \
    --input hosts=34.204.74.133,admin@3.94.251.138 \
    --input dryRun=false

Mitigation needs root, or passwordless sudo for tee and rmmod with any arguments — for example ubuntu ALL=(root) NOPASSWD: /usr/bin/tee, /usr/sbin/rmmod. If sudo would ask for a password, the host is reported as failed and nothing is run.

›Mitigation results

# Dirty Frag Mitigation: APPLIED

┌───────────────┬────────────────┬─────────┐
│ Host          │ Kernel         │ Status  │
├───────────────┼────────────────┼─────────┤
│ 34.204.74.133 │ 7.0.0-1004-aws │ APPLIED │
├───────────────┼────────────────┼─────────┤
│ 3.94.251.138  │ 7.0.0-1004-aws │ APPLIED │
└───────────────┴────────────────┴─────────┘

## Commands

┌──────┬───────────────────────────────────────────────────────────────────────────────────────┬─────────────────────────────────────────────┐
│ Step │ Command                                                                               │ Purpose                                     │
├──────┼───────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────┤
│ 1    │ printf 'install esp4 /bin/false\n...' | sudo -n -- tee /etc/modprobe.d/dirtyfrag.conf │ Blocklist esp4/esp6/rxrpc modules           │
├──────┼───────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────┤
│ 2    │ sudo -n -- rmmod esp4 (likewise esp6, rxrpc; only if listed in /proc/modules)         │ Unload modules from running kernel          │
├──────┼───────────────────────────────────────────────────────────────────────────────────────┼─────────────────────────────────────────────┤
│ 3    │ echo 3 | sudo -n -- tee /proc/sys/vm/drop_caches                                      │ Flush page cache (clears corrupted entries) │
└──────┴───────────────────────────────────────────────────────────────────────────────────────┴─────────────────────────────────────────────┘

Commands run as root directly, or through sudo -n (never prompts) for other users.

[03]

References

Find every exposed kernel

Pull the scanner and run it across every Linux host you own.

$ swamp extension pull @swamp/cve/dirtyfrag