CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags
In the Linux kernel, the following vulnerability has been resolved:
Other sources
The “Dirty Frag” vulnerability is a chained local privilege escalation (LPE) issue in the Linux kernel that combines flaws in the ESP/XFRM and RXRPC subsystems to allow an unprivileged local attacker to gain root access on major Linux distributions. The attack abuses kernel page-cache manipulation and network protocol handling to overwrite privileged binaries and execute arbitrary code with elevated privileges. Exploitation differs by distribution: the ESP issue affects systems permitting unprivileged user namespaces, while the RXRPC issue impacts distributions with RXRPC enabled, such as Ubuntu. Together, the vulnerabilities provide broad cross-distribution root compromise capability, with mitigations involving disabling vulnerable kernel modules (esp4, esp6, and rxrpc) until upstream patches are fully merged and deployed.
— Red Hat
xfrm: esp: avoid in-place decrypt on shared skb frags
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.259-1Fixed in 6.1.176-1Fixed in 6.12.94-1Fixed in 6.12.95-1Fixed in 7.1.3-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.176-1~deb11u1 - Upgrade
Upgrade
Linux kernel xfrm: espto a version that resolves this vulnerability.Patch xfrm: esp: avoid in-place decrypt on shared skb frags - Configuration
Disable the vulnerable ESP IPv4 module (esp4) until upstream patches are fully merged and deployed.
Linux kernel module esp4 = disabled - Configuration
Disable the vulnerable ESP IPv6 module (esp6) until upstream patches are fully merged and deployed.
Linux kernel module esp6 = disabled - Configuration
Disable the vulnerable RXRPC module (rxrpc) until upstream patches are fully merged and deployed.
Linux kernel module rxrpc = disabled - Compensating control
Until upstream patches are fully merged and deployed, mitigate cross-distribution root compromise by disabling vulnerable kernel modules esp4, esp6, and rxrpc (per the cited Dirty Frag mitigation guidance).
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2026-43284?
CVE-2026-43284 is classified as a medium severity vulnerability.
How do I fix CVE-2026-43284?
To fix CVE-2026-43284, upgrade your Linux kernel to the latest stable version that addresses this vulnerability.
What systems are affected by CVE-2026-43284?
CVE-2026-43284 affects the Linux kernel when using shared skb fragments.
What type of vulnerability is CVE-2026-43284?
CVE-2026-43284 is a memory handling vulnerability related to in-place decryption on shared skb fragments.
When was CVE-2026-43284 published?
CVE-2026-43284 was published in the year 2026.