Dirty Frag Extends Linux’s Page-Cache Bug Class Into ESP and RxRPC

Dirty Frag is a Linux kernel local privilege-escalation issue that extends the page-cache corruption bug class associated with Dirty Pipe and Copy Fail into networking code paths used by ESP/IPsec and RxRPC.

The issue is tracked as CVE-2026-43284 for the xfrm/ESP path and CVE-2026-43500 for the RxRPC path. Together, the bugs can allow a local unprivileged user to corrupt page-cache-backed data and escalate to root on vulnerable Linux systems.

This is not a wormable remote vulnerability. The risk begins after an attacker has local code execution, such as a compromised SSH account, web shell, low-privileged service account, or container foothold. From there, Dirty Frag can turn “some access” into root access very quickly.

What happened

Dirty Frag was publicly disclosed after coordinated disclosure timelines broke down and public proof-of-concept code became available. The exploit chain targets Linux kernel networking and memory-fragment handling behavior involving esp4, esp6, xfrm, and rxrpc.

CVE-2026-43284 affects ESP support used by IPsec. The vulnerable path can decrypt in place over shared socket-buffer fragments that are backed by page-cache data. CVE-2026-43500 affects RxRPC, a protocol used by AFS. In both cases, externally backed fragments can be modified by kernel crypto paths that should first have copied or unshared the data.

The result is a page-cache write primitive that can be shaped into local privilege escalation.

Why it matters

Local privilege escalation flaws are post-compromise accelerators. They let attackers move from a low-privileged shell to root, then disable controls, tamper with logs, read credentials, change system binaries, and persist.

Dirty Frag is especially concerning because public reporting describes it as deterministic rather than race-dependent. That means defenders should not treat it like a flaky lab-only crash bug. If vulnerable modules are present and reachable, a local foothold may be enough.

Containerized environments deserve special attention. Containers share the host kernel, so a compromised workload may inherit host exposure if it can reach the relevant socket families or kernel modules.

Affected systems

Affected exposure depends on kernel version, distribution backports, module configuration, and container policy.

Known impacted components include:

• esp4
• esp6
• xfrm/IPsec ESP paths
• rxrpc
• AFS-related RxRPC usage

Distributions and platforms with advisories or public impact notes include Ubuntu, Debian, Red Hat Enterprise Linux, OpenShift, SUSE Linux Enterprise, Fedora-family systems, AlmaLinux, CentOS Stream, and openSUSE.

Technical details

Dirty Frag abuses in-place cryptographic processing over shared socket-buffer fragments.

For CVE-2026-43284, MSG_SPLICE_PAGES can attach pages from a pipe directly into socket buffers. In vulnerable ESP receive paths, those fragments may be decrypted in place without first making a private copy. That allows attacker-controlled page-cache-backed memory to be modified through kernel networking code.

For CVE-2026-43500, the RxRPC path has a similar shared-fragment problem. DATA and RESPONSE packet handling can reach in-place decryption paths when externally owned paged fragments are present.

The practical result is page-cache poisoning. In public demonstrations, that class of primitive can be used to modify cached contents of sensitive files or setuid binaries and then trigger root-level execution.

Detection guidance

Detection is mostly behavioral. There is no clean network-only signature because exploitation is local and uses normal Linux syscalls.

Defenders should monitor for:

• Unexpected creation of AF_RXRPC sockets.
• Unusual AF_KEY or XFRM netlink activity by unprivileged users.
• Attempts to load or use esp4, esp6, rxrpc, xfrm_user, ipcomp4, or ipcomp6.
• Unexpected privilege transitions through su, setuid binaries, or shell execution.
• Suspicious use of splice, vmsplice, sendmsg, setsockopt, and related syscalls by low-privileged processes.
• Unexpected changes to setuid binaries, /etc/passwd, /etc/shadow, PAM files, SSH configuration, or authentication plugins.
• Container workloads creating socket families they do not normally require.

Microsoft Defender has published Dirty Frag-related detections, and Sysdig has published runtime/Falco-oriented detection guidance for ESP and RxRPC paths.

Recommended actions

Patch first. Where patched kernels are not yet available or cannot be deployed immediately, block and unload vulnerable modules if operationally safe.

Short-term mitigations include blocklisting esp4, esp6, and rxrpc. This may break IPsec VPN or AFS/RxRPC functionality, so validate business impact before broad deployment.

Container operators should restrict AF_KEY, AF_RXRPC, and XFRM netlink access through runtime security policy where possible. Hosts running untrusted workloads, CI/CD runners, shared shell environments, jump boxes, and internet-facing application servers should be prioritized.

After suspected exploitation, mitigation alone may not clean contaminated page cache. Validate file integrity and consider rebooting or carefully dropping caches after incident-response review.