Cve/dirtyfrag

Detects and mitigates the Dirty Frag Linux local privilege escalation vulnerability class (CVE-2026-43284 + CVE-2026-43500), which chains two kernel bugs to write attacker-controlled bytes into the page cache of suid binaries or /etc/passwd via splice().

Methods

• scan — scan a single host (local, SSH, or Docker container)
• scanFleet — scan multiple hosts in parallel over SSH; user@host entries log in as their own user
• mitigate — scan-then-fix: checks vulnerability first, blocklists modules, unloads them, and flushes page cache on affected hosts only

What It Detects

Kernel module availability (esp4/esp6/rxrpc), patch status, user namespace exposure, module blocklisting, page cache corruption of /usr/bin/su and /etc/passwd, XFRM SA exploit patterns, and RxRPC key artifacts.

No packages required on target hosts — all checks use POSIX utilities and procfs/sysfs, except the XFRM SA check, which uses ip (iproute2) and needs root; without them it is reported as not checked.