Question 1

Is Dirty Frag exploitable over the network without local access?

Accepted Answer

Public CVE metrics classify these issues as local attack vector (AV:L). An attacker still needs a path to execute code or interact with vulnerable kernel paths as described in NVD and vendor advisories—not anonymous remote exploitation alone.

Question 2

Do I already need root to exploit Dirty Frag?

Accepted Answer

CVSS vectors list low-privilege requirements for local exploitation (PR:L). The concern is escalation from a low-privileged local context toward higher privileges—confirm exact wording on each CVE's NVD entry.

Question 3

Will disabling kernel modules fully mitigate everyone?

Accepted Answer

Only when those subsystems are unused and your vendor recommends module restrictions as interim risk reduction. Blocking ESP modules can disrupt IPsec VPNs; restricting RxRPC can affect Andrew File System workloads. Prefer vendor-supported kernel updates.

Question 4

Do containers isolate hosts from Dirty Frag?

Accepted Answer

Containers share the host kernel. Exploitability depends on kernel version and isolation boundaries—patch the host kernel per your distribution’s guidance.

Question 5

Why are CVE-2026-43284 and CVE-2026-43500 chained?

Accepted Answer

Research documentation explains that the ESP-oriented primitive may require capabilities such as creating namespaces while distributions differ on hardening (for example AppArmor policies around user namespaces). RxRPC-related exposure may behave differently across distributions where modules ship or load by default. Chaining covers complementary blind spots on common setups—see the Technical page for attribution.

Question 6

How does Dirty Frag relate to Copy Fail?

Accepted Answer

Per researcher disclosure, investigation into Copy Fail motivated this work; the xfrm-ESP primitive shares conceptual lineage while differing in trigger conditions from publicly discussed Copy Fail mitigations such as denying algif_aead—still validate against vendor kernels.

Question 7

Why is it called "Dirty Frag"?

Accepted Answer

The researcher describes it as extending the bug family associated with Dirty Pipe and ties naming to manipulation of skb fragment-related structures—informal branding only; authoritative identifiers remain CVE-2026-43284 and CVE-2026-43500.

Field	CVE-2026-43284	CVE-2026-43500
Subsystem	xfrm ESP input / UDP splice skb fragments	RxRPC DATA / RESPONSE handlers
CWE (NVD)	CWE-123 (per CISA-ADP listing)	CWE-787
CVSS 3.1 (publishers)	CNA kernel.org 8.8 HIGH vs CISA-ADP 7.8 HIGH — verify on NVD	NIST / CISA-ADP 7.8 HIGH — verify on NVD
Where to confirm coverage	Audit each CVE separately: inspect CPE configuration data on CVE-2026-43284 and CVE-2026-43500 NVD listings, then reconcile your fleet against distribution security trackers on the Distros page.

Dirty Frag — Linux kernel local privilege escalation

At a glance

Pick your starting point

Operations & SOC

Security engineering

Compliance & evidence

CVE snapshot

Administrators

Technical readers