Dirty Frag: Linux kernel hit by second major security flaw in two weeks
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-43284 | Linux kernel ESP-in-UDP decrypts in place over shared splice pages (CWE-123) CVE-2026-43284 is a write-what-where memory-safety flaw (CWE-123) in the Linux kernel's xfrm/ESP (IPsec) code: the IPv4/IPv6 UDP datagram send paths fail to mark pages spliced into a UDP skb with SKBFL_SHARED_FRAG when MSG_SPLICE_PAGES attaches pipe pages, so the ESP input path wrongly treats the packet as privately owned and decrypts it in place over memory the skb does not exclusively own. It is triggered when locally generated UDP traffic built from spliced pipe pages is processed by the ESP decryption path, typically in IPsec NAT-traversal (ESP-in-UDP, UDP port 4500) configurations; the in-place decrypt can corrupt or expose data still referenced by the pipe or other owners of those shared pages. A local, low-privileged attacker can thereby cause high-severity confidentiality, integrity, and availability impact that extends beyond the packet itself (CVSS 3.1: 8.8, scope changed); no remote or unauthenticated trigger is described. Any Linux system running a kernel with the vulnerable UDP splice and ESP-in-UDP paths is affected, most importantly IPsec VPN gateways and clients; the advisory lists no affected version ranges. No public proof-of-concept or confirmed in-the-wild exploitation is known (not on CISA KEV), but EPSS assigns a 93.2% probability of exploitation within 30 days (100th percentile), so patching should not be deferred. Do: Apply your distribution's kernel security update containing the xfrm/esp fix for CVE-2026-43284 and reboot into the patched kernel, prioritizing IPsec VPN gateways and clients that use ESP-in-UDP NAT-T (UDP/4500). Until patched, restrict untrusted local users from sending splice-based (MSG_SPLICE_PAGES) UDP traffic through IPsec-protected paths, or temporarily avoid ESP-in-UDP encapsulation where feasible. Verify the fix via your vendor's package changelog, as the advisory does not name specific fixed version numbers. | 8.8 | 93% |
| mass≈1M+ Linux installations carry the vulnerable code in default distro kernels; hundreds of thousands of hosts expose IPsec NAT-T (UDP/4500) in public internet… | ||
| CVE-2026-43500 | Out-of-bounds write in Linux kernel AF_RXRPC decryption enables root access CVE-2026-43500 is a memory-corruption flaw in the Linux kernel's AF_RXRPC (rxrpc) subsystem: the DATA and RESPONSE packet handlers only copy received skbs to a linear buffer before decryption when the skb is marked cloned, so non-cloned skbs that still carry externally owned paged fragments (SKBFL_SHARED_FRAG, e.g. set by splice() into a UDP socket, or skbs with a frag_list) fall through to the in-place decryption path. In that path the shared fragment pages are bound directly into the AEAD/skcipher scatter-gather list via skb_to_sgvec(), so decryption writes into pages shared with other kernel or user contexts, causing out-of-bounds/write-what-where corruption (CWE-787/CWE-123), notably via the splice-into-UDP-socket loopback vector. A local low-privileged attacker who can get the machine to process such rxrpc packets can corrupt kernel memory and escalate to root (CVSS 3.1: 7.8 high, local vector, high confidentiality/integrity/availability impact). Affected systems are Linux kernels with the AF_RXRPC subsystem available — the transport used by the AFS/kAFS network filesystem — which mainstream distribution kernels ship as a module or built-in; no specific affected or fixed version ranges are provided in the data. It is not on CISA's KEV list and the CVE record lists no public PoC, but news reports describe a 'Dirty Frag' local privilege-escalation exploit giving root across major distributions and a released PoC, and EPSS puts the 30-day exploitation probability at about 93% (100th percentile). Do: Apply the kernel update containing the rxrpc fix as soon as your distribution ships it — the fix extends the unshare gate to also unshare skbs with frag lists or shared fragments before in-place decryption; no fixed version numbers are given in the available data, so follow your distro's security advisory. Until patched, check whether rxrpc/AFS is in use (e.g. 'lsmod | grep rxrpc') and avoid or restrict local splice()-into-UDP/loopback AFS traffic on multi-user hosts. | 7.8 | 93% |
| mass≈1 billion+ Linux installations (mainstream distro kernels ship AF_RXRPC) |
Full article769 words · extracted from therecord.media · click to collapse
A second major Linux vulnerability has been disclosed in as many weeks, this time by an independent security researcher who published a working exploit after a coordinated disclosure embargo collapsed. Nicknamed “Dirty Frag,” the issue was found in the same area of the Linux kernel that produced last month’s Copy Fail bug, and also allows anyone with a basic account on an affected computer to seize full administrative control. Copy Fail had prompted concern as it provided hackers with an escape route from cloud containers, meaning a compromised application running inside a supposedly isolated environment can break out and take control of the entire host server — a major risk given the cloud industry’s dependence on Linux distributions. Dirty Frag also allows for container escape, and similarly affects nearly all Linux distributions in use today. It was discovered by Hyunwoo Kim, and exploits the same underlying design flaw in how Linux manages files in memory. Theori, the firm that discovered Copy Fail with the assistance of its own AI tooling, separately noted at the time that its own scanning had surfaced additional vulnerabilities in the same area of the kernel, although these remained under private disclosure. Kim reported the flaw he discovered privately to Linux maintainers on April 30, giving them time to prepare patches as per the standard coordinated disclosure process. But, on May 7, Kim said “an unrelated third party independently published the exploit,” prompting him to release his full writeup and his own working exploit on the same day. It is not known who the third party is. “Because the embargo has currently been broken, no patch or CVE exists,” Kim wrote on the oss-security mailing list, adding that after consulting Linux maintainers, and at their request, he had decided to publish his writeup. The Dirty Frag flaw is being tracked as two linked vulnerabilities — CVE-2026-43284 and CVE-2026-43500 — each affecting a different part of the Linux kernel's networking code. According to Kim's writeup, neither flaw is sufficient for a reliable attack on its own; chaining both is what makes the exploit work consistently. Like Copy Fail, the attack corrupts files in memory without touching the originals on disk, leaving standard security monitoring tools unable to detect it. Red Hat confirmed both flaws affect its enterprise Linux products and issued an advisory, classifying them as Important severity and expediting patches across supported RHEL releases. AlmaLinux and Ubuntu both published patches and mitigations by May 8. SUSE, Debian, Fedora and Amazon Linux had all acknowledged the issue with patches in progress. The Copy Fail and Dirty Frag disclosures are an early illustration of a problem Britain's National Cyber Security Centre had warned about just days earlier, when the agency’s chief technology officer Ollie Whitehouse said AI tools were about to prompt a surge of urgent software updates. Whitehouse explained that the tools, in the hands of skilled researchers, were beginning to expose the enormous scale of “technical debt” — effectively insecure or outdated code — embedded in critical infrastructure. AI tools have compressed the time it takes to discover latent vulnerabilities that have accumulated over the past few decades, turning what would once have taken years of vulnerability hunting into a much shorter period of work. The patching process — which for open source software like Linux depends on a global network of volunteer and corporate maintainers, each responsible for their own distribution — can struggle to keep up even under ideal conditions. When an embargo breaks, as happened with Dirty Frag, that window disappears entirely. That strain is visible elsewhere in the open source community. In March, HackerOne paused its bug bounty program citing a “worsening imbalance between vulnerability discoveries and the ability for open source maintainers to remediate them,” and attributing the shift to AI-assisted research expanding the speed and volume of vulnerability discovery. “This is why we are encouraging all organisations to prepare now for when a ‘patch wave’ arrives,” Whitehouse wrote in his blog, describing the agency’s expectation that there was going to be a rush of software updates requiring urgent application across entire technology stacks. The NCSC said that administrators preparing for a patch wave now could help limit disruption later, warning that delays in applying fixes during periods of heightened vulnerability discovery could significantly increase the risk of compromise. Looming patch wave
No previous article
No new articles
Alexander Martin
is the UK Editor for Recorded Future News. He was previously a technology reporter for Sky News and a fellow at the European Cyber Conflict Research Initiative, now Virtual Routes. He can be reached securely using Signal on: AlexanderMartin.79
Text extracted automatically; images, tables and formatting may be missing. Original: https://therecord.media/dirty-frag-linux-kernel-hit-by-second-major-bug