SG-2026-0024

Dirty Frag primitive-only PoC Readable N4C demonstrator for CVE-2026-43284 XFRM/ESP and CVE-2026-43500 RxRPC/RXKAD. The PoC answers one question: can an unprivileged process change the page cache of a root-owned, read-only file through a sharedskbuff fragment? It does not overwrite /usr/bin/su or...

dirtyfrag

Dirty Frag: Universal Linux LPE Abstract This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write CVE-2026-43284 vulnerability and the...

CVE-2026-31635-DirtyDecrypt

CVE-2026-31635 · DirtyDecrypt Linux local privilege escalation in the RxRPC/GSSAPI decryption path. A missing skbcowdata check in rxgkdecryptskb allows an unprivileged local attacker to corrupt page cache pages and overwrite in-memory contents of read-only files. Contents Overview Quick Start...

DIRTY-FRAG-Detection-with-Wazuh-4.14.4

DIRTY FRAG Detection with Wazuh 4.14.4 - CVE-2026-43284 / CVE-2026-43500 Detection engineering for the Dirty Frag kernel LPE - Ubuntu / RHEL / Debian / Amazon Linux What is Dirty Frag? CVE-2026-43284 / CVE-2026-43500 is a Linux kernel Local Privilege Escalation LPE that chains two independent...

CVE-2026-43284

Dirty Frag: Universal Linux LPE Abstract This document explains the Dirty Frag vulnerability class, discovered and reported by Hyunwoo Kim @v4bel. By chaining xfrm-ESP Page-Cache Write CVE-2026-43284 with RxRPC Page-Cache Write CVE-2026-43500, an attacker can escalate to root on major Linux...

yc-mk8s-copy-fail-mitigation

Copy Fail / Dirty Frag Mitigation for Yandex Managed Kubernetes Automatic application of mitigation for vulnerabilities CVE-2026-31431, CVE-2026-43284 and CVE-2026-43500 in the Linux kernel on all worker nodes of a Yandex Managed Kubernetes cluster. Vulnerability Description CVE ID: CVE-2026-4328...

Dirty-Frag-Analysis

Dirty Frag Deep Technical Analysis CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC Linux kernel local privilege escalation vulnerability — PoC reverse engineering · Shellcode breakdown · Patch principles · Detection script Vulnerability Overview Dirty Frag exploits two independent vulnerabilities,...

DirtyFrag-Detector

🔍 Dirty Frag — CVE-2026-43284 / CVE-2026-43500 Detection Script TL;DR: There are two new Linux kernel bugs. This script tells you if you're vulnerable. Patch your stuff. What's this about? On May 7th 2026, a vulnerability class called Dirty Frag was publicly disclosed by security researcher Hyunw...

afalg-check

Itsumma AFALG Check Diagnostic utility for Linux that checks: availability of AFALG / algifaead and helps assess the risk of CVE-2026-31431 copy-fail; the presence of an attack surface for the Dirty Frag vulnerability class xfrm-ESP Page-Cache Write + RxRPC Page-Cache Write chain across the esp4,...

DirtyFrag-go

dirtyfrag-go Two bugs. One shell. No disk writes. Go port of dirtyfrag CVE-2026-43284 / CVE-2026-43500. How it works tl;dr The bug class is in the Linux kernel XFRM subsystem. When a file page is spliced into a pipe and then into an ESP-encrypted socket, the kernel decrypts the ESP payload in-pla...

CVE-2026-43284

🚨 CVE-2026-43284 — Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation Overview Field| Detail ---|--- CVE| CVE-2026-43284 xfrm/ESP + CVE-2026-43500 RxRPC Nickname| Dirty Frag CVSS| 7.8 HIGH Type| Local Privilege Escalation LPE Introduced| Linux kernel 4.10 2017, commit cac2661c53f3...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31637)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: reject undecryptable rxkad response tickets rxkaddecryptticket decrypts the RXKAD response ticket and then parses the buffer as plaintext without checking whether cryptoskcipherdecrypt succeeded. A malformed RESPONSE can...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-23066)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix recvmsg unconditional requeue If rxrpcrecvmsg fails because MSGDONTWAIT was specified but the call at the front of the recvmsg queue already has its mutex locked, it requeues the call - whether or not the call is alrea...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31676)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: only handle RESPONSE during service challenge Only process RESPONSE packets while the service connection is still in RXRPCCONNSERVICECHALLENGING. Check that state under statelock before running response verification and...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31696)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix missing validation of ticket length in non-XDR key preparsing In rxrpcpreparse, there are two paths for parsing key payloads: the XDR path for large payloads and the non-XDR path for payloads = 28 bytes. While the XDR...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31630)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: proc: size address buffers for %pISpc output The AFRXRPC procfs helpers format local and remote socket addresses into fixed 50-byte stack buffers with '%pISpc'. That is too small for the longest current-tree IPv6-with-port...

Siemens SIMATIC S7-1500 TM MFP Improper Input Validation (CVE-2026-31642)

In the Linux kernel, the following vulnerability has been resolved: rxrpc: Fix call removal to use RCU safe deletion Fix rxrpc call removal from the rxnet-calls list to use listdelrcu rather than listdelinit to prevent stuffing up reading /proc/net/rxrpc/calls from potentially getting into an...

CVE-2026-43284

🚨 CVE-2026-43284 - Dirty Frag 🚨 Universal Linux Kernel Local Privilege Escalation 📋 Overview Dirty Frag also known as Copy Fail 2 is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems...

DirtyFrag

Dirty-Frag Linux CVE-2026-43284 & CVE-2026-43500 Copied from @V4bel : Thanks : This document describes the Dirty Frag vulnerability class, first discovered and reported by Hyunwoo Kim @v4bel, which can obtain root privileges on major Linux distributions by chaining the xfrm-ESP Page-Cache Write...

Dirty-Frag-CVE-2026-43284

Dirty Frag CVE-2026-43284 and CVE-2026-43500 Exploit Reproduction and Detection Lab for a Linux kernel local privilege escalation chain. Status: VERIFIED. I completed the reproduction, the fileless verification, and the syscall-level detection in the lab kernel 6.18.9+kali-amd64. This document is...