What is Dirty Frag?

Dirty Frag is a local privilege escalation vulnerability chain that exploits logic bugs in Linux’s networking and authentication stacks to corrupt data in the kernel’s page cache, enabling an unprivileged account to escalate to root. 

It works by targeting two separate networking subsystems: the IPsec Encapsulating Security Payload, or xfrm-ESP, path, tracked as CVE-2026-43284, and the RxRPC authentication path, tracked as CVE-2026-43500.

By chaining these flaws, attackers can modify what should be read-only, page-cache-backed system files in memory and then trigger them to run with elevated privileges, without ever touching your file system.

Also: This critical Linux vulnerability is putting millions of systems at risk – how to protect yours

Once in, Dirty Frag exploits “page-cache write primitives” in kernel fast paths used for encrypted networking and remote file system authentication. By carefully choosing the target, an attacker can overwrite pieces of ostensibly read-only files in memory, such as executables or configuration files, and then execute or reload the modified files as root. 

From there, the sky’s the limit, and attackers can do pretty much whatever they want.

The good news — yes, there is some — is that attackers typically need an existing foothold, such as an unprivileged shell via SSH, a web shell, or a compromised container, to use Dirty Frag to escalate.

On the other hand, because the underlying bug is a logic error rather than a timing-sensitive race, the exploit is unusually reliable and does not cause kernel panics when it fails. In other words, someone can attack your Linux system over and over again until they break in, and you’ll never know about it.

Defenders scrambled to assess exposure

It did not take long for attackers to take notice. Public exploit code was quickly mirrored across security blogs, GitHub repositories, and discussion forums, leaving defenders scrambling to assess exposure.

Also: Worried about the nationwide Canvas data breach? Take these 6 steps now

According to Microsoft’s threat intelligence team, Dirty Frag has already been observed in action. Hackers are using it to upgrade limited footholds on Linux systems to full root control across servers, cloud workloads, and containers.

So, who’s at risk? 

I’m sorry to say it’s pretty much everyone who uses any Linux distribution. Dirty Frag affects a wide range of Linux environments, from bare-metal servers and enterprise distributions to container hosts and cloud instances. This includes current and earlier releases of Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, Fedora, and openSUSE Tumbleweed, among others.

Canonical, Ubuntu’s parent company, warns: “In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host.” That’s the ultimate cloud-native computing nightmare.

Fortunately, “A proof-of-concept exploit has not been published yet for container escape.” 

So far. To the best of our knowledge. We hope.

Also: Best VPN services: Expert tested and recommended

While many of you were celebrating Mother’s Day, the Linux kernel community spent the weekend addressing the problem. CVE-2026-43284, the xfrm-ESP component, received an upstream fix in the mainline kernel on May 8, less than 24 hours after public disclosure, though that fix now needs to be backported across the many supported stable trees.

The RxRPC flaw, tracked as CVE-2026-43500, remains under evaluation. As of this writing, no upstream patch had been finalized. Linux vendors are issuing their own advisories and updates as they integrate the upstream changes.

What you should do immediately

Linux distributors, cloud providers, and hosting providers are urging customers to update to the latest kernel packages as they become available. They’re also urging administrators to blacklist esp4, esp6, and rxrpc modules as a stopgap. Keep in mind, however, that if you do so, you’re likely to disrupt IPsec VPNs or AFS-based workloads. On the other hand, you’ll be safer that way.

Also: Why Edge stores your passwords in plaintext, according to Microsoft

Debian and Ubuntu-related Linux distros

Canonical suggests the following steps. These will work on Ubuntu and related Linux distributions, like Mint.

Step 1. Block the modules

• Block the modules by creating a /etc/modprobe.d/dirty-frag.conf file:
• echo “install esp4 /bin/false” | sudo tee /etc/modprobe.d/dirty-frag.conf
• echo “install esp6 /bin/false” | sudo tee -a /etc/modprobe.d/dirty-frag.conf
• echo “install rxrpc /bin/false” | sudo tee -a /etc/modprobe.d/dirty-frag.conf
• Regenerate the initramfs images to prevent the modules from being loaded during early boot:
• sudo update-initramfs -u -k all

Step 2. Unload modules

• Unload the modules, in case they are already loaded:
• sudo rmmod esp4 esp6 rxrpc 2>/dev/null

Step 3. Confirm the modules aren’t loaded

• Check whether the modules are still loaded:
• grep -qE ‘^(esp4|esp6|rxrpc) ‘ /proc/modules && echo “Affected modules are loaded” || echo “Affected modules are NOT loaded”
• If the previous action indicates that the modules are not loaded, no further action is required. However, unloading the modules may not be possible if applications are already using them. In these instances, a system reboot will enforce their blocking, but it will affect applications:
• sudo reboot
• Once kernel updates are available and installed, the mitigation can be removed:
• sudo rm /etc/modprobe.d/dirty-frag.conf
• sudo update-initramfs -u -k all

Also: The best mobile antivirus software: Expert tested and reviewed

Red Hat and related Linux distros

Red Hat suggests you run:

• printf ‘install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n’ > /etc/modprobe.d/dirtyfrag.conf rmmod esp4 esp6 rxrpc 2>/dev/null; true

This approach, which will require disabling IPsec and AFS-based programs, will also work on CentOS, Rocky Linux, AlmaLinux, and other RHEL-related Linux distros.

Also: I’ve used Windows for decades, but I tried Linux to see if it’s truly ‘easy’ now – and one thing surprised me

SUSE Linux fixes

SUSE has a similar solution with the same warning about IPsec and AFS.

Create:

/etc/modprobe.d/10-copyfail2-fix.conf to remediate with the following lines:

• blacklist esp4
• blacklist esp6
• blacklist rxrpc
• install esp4 /bin/false
• install esp6 /bin/false
• install rxrpc /bin/false

The details vary from distro to distro, but the temporary fix is always the same: Use a modprobe configuration file to disable the potentially affected programs until the kernel patches are available and installed. 

Once that’s done, you can delete the emergency fixes and get back to business as usual.

Also: Google bets $32B on AI agent cyber force as security arms race escalates

Until full kernel fixes are broadly deployed and systems are rebooted, you should mitigate your system as soon as possible. After all, if you have even a single compromised user account, an attacker can use Dirty Frag to take complete control of your infrastructure.

Now, if you’ll excuse me, I have a bunch of servers and workstations to fix.