Copy_Fail2-Electric_Boogaloo

Copy Fail 2: Electric Boogaloo Unprivileged Linux LPE via xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path. Page-cache write into any readable file. Overwrites a nologin line in /etc/passwd with sick::0:0:...:/:/bin/bash and sus into it. Same class as Copy Fail CVE-2026-31431, different subsystem...

PT-2026-116780

In the Linux kernel, the following vulnerability has been resolved: nfp: hold IPsec RX state under the XArray lock nfp net ipsec rx drops the XArray lock before taking a reference to the xfrm state it found. The delete path can erase the entry and drop the last state reference in that interval. R...

CVE-2026-98417

A flaw was found in the Linux kernel's XFRM IPsec encryption framework subsystem. A remote attacker could exploit this issue by sending specially crafted ESP-in-TCP Encapsulating Security Payload over Transmission Control Protocol packets with invalid transport header offsets. This improper...

DirtyClone

DirtyClone DirtyClone is a diagnostic, proof-of-concept local privilege escalation tool written in C. It targets a kernel/XFRM-related exploit path described in the source as CVE-2026-43503 and is intended only for authorized security research in controlled environments. Overview This repository...

SUSE CVE-2026-98417

In the Linux kernel, the following vulnerability has been resolved: net: xfrm: reject unrepresentable espintcp transport headers ESP-in-TCP can hand xfrm packets whose transport header offset no longer fits after the stream parser trims the TCP envelope. The plain transport header reset truncates...

SG-2026-0024

Dirty Frag primitive-only PoC Readable N4C demonstrator for CVE-2026-43284 XFRM/ESP and CVE-2026-43500 RxRPC/RXKAD. The PoC answers one question: can an unprivileged process change the page cache of a root-owned, read-only file through a sharedskbuff fragment? It does not overwrite /usr/bin/su or...

CVE-2026-31431

CopyFail2 CVE-2026-31431 - Python Implementation Python port of the CopyFail2 kernel exploit leveraging xfrm ESP-in-UDP MSGSPLICEPAGES no-COW fast path for unprivileged Linux local privilege escalation. Replaces a nologin/false entry in /etc/passwd with a passwordless uid-0 user and drops into a...

yc-mk8s-copy-fail-mitigation

Copy Fail / Dirty Frag Mitigation for Yandex Managed Kubernetes Automatic application of mitigation for vulnerabilities CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500 in the Linux kernel on all worker nodes of a Yandex Managed Kubernetes cluster. Vulnerability Description CVE ID: CVE-2026-4328...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.16.73 bug fix and security update

Red Hat OpenShift Container Platform release 4.16.73 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.16. Red Hat Product Security has rated this update as having a...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.17.59 bug fix and security update

Red Hat OpenShift Container Platform release 4.17.59 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.17. Red Hat Product Security has rated this update as having a...

Dirty-Frag-Kubernetes-PoC

Dirty Frag CVE-2026-43284 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag Linux kernel page-cache corruption vulnerability through shared container image...

Dirty-Frag-Analysis

Dirty Frag Deep Technical Analysis CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC Linux kernel local privilege escalation vulnerability — PoC reverse engineering · Shellcode breakdown · Patch principles · Detection script Vulnerability Overview Dirty Frag exploits two independent vulnerabilities,...

CVE-2026-46300_Fragnesia

🧨 Fragnesia — CVE-2026-46300 Linux Kernel LPE Audit & Exploit Toolkit · Page-Cache / XFRM ESP-in-TCP espintcp Regression Interactive audit → LPE prerequisite detection → Automated exploit execution after confirmation ⚠️ Ethical & Legal Warning This tool is intended solely for legitimate and...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, Linux, Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: Validates the prefix length of new SA entries using the SA family, when sel.family is unset. This extends the validation introduced in commit 07bf7908950a “xfrm: Validates address prefix lengths in the xfrm selector”. The...

Astra Linux – Vulnerability found in Linux 5.10, Linux 6.1, and Linux 5.15

In the Linux kernel, the following vulnerability has been resolved: xfrm: ESP: restoring the combined single-frag-length gate. The ESP fast path appends the trailer in espoutputhead before espoutputtail allocates the destination page frag. Currently, the head-side gate checks skb-datalen and tail...

Important: Red Hat Security Advisory: OpenShift Container Platform 4.18.57 bug fix and security update

Red Hat OpenShift Container Platform release 4.18.57 is now available with updates to packages and images that fix several bugs and add enhancements. This release includes a security update for Red Hat OpenShift Container Platform 4.18. Red Hat Product Security has rated this update as having a...

DirtyFrag-for-dummies

Dirty Frag / CVE-2026-43284 — Research Notes Overview This repository contains a cleaned-up technical diagram and supporting notes for the Linux kernel vulnerability commonly referred to as Dirty Frag and tracked for the xfrm-ESP path as CVE-2026-43284. The issue belongs to the broader Dirty Frag...

CVE-2026-43284-dirtyfrag-detection

DirtyFrag CVE-2026-43284 PoC Validation and auditd Detection Scope: Linux Local Privilege Escalation LPE validation focused on the XFRM/ESP path associated with CVE-2026-43284. This repository contains an English report and evidence artifacts from a controlled laboratory validation of the public...

CVE-2026-43284-DIRTY-FRAG-

CVE-2026-43284-DIRTY-FRAG- Detailed technical analysis of CVE-2026-43284 Dirty Frag local privilege escalation flaw in the Linux kernel. CVE-2026-43284 commonly referred to as part of the Dirty Frag vulnerability suite is a critical local privilege escalation LPE flaw in the Linux kernel. It stem...

Unbreakable Enterprise kernel security update

6.12.0-207.111.5.3 - mm/pagewalk: fix stale walk-action escaping walkpmdrange Hyunwoo Kim Orabug: 40157478 CVE-2026-89754 - exec: Cleanup POSIX timers right after dethread Hyunwoo Kim Orabug: 40157474 CVE-2026-98260 6.12.0-207.111.5.2 - PCI: Fix BAR resize for devices on a root bus Liz Fong-Jones...