Dirty Frag: A Second Linux Kernel Zero-Day in Five Weeks Hands Root via Chained ESP and rxrpc Page-Cache Bugs
CVE-2026-43284 and CVE-2026-43500 chain two page-cache write primitives in IPsec ESP and rxrpc to give unprivileged users root on every major Linux distribution shipped in the last nine years.
Overview
A second Linux kernel local privilege escalation chain in roughly five weeks went public on May 7, 2026, after an unrelated third party broke an active embargo, according to BleepingComputer. The chain, dubbed Dirty Frag and tracked as CVE-2026-43284 and CVE-2026-43500, combines two page-cache write primitives in the kernel’s IPsec ESP and rxrpc subsystems to hand an unprivileged local user root on virtually every major Linux distribution shipped in the last nine years, as reported by The Hacker News.
The disclosure lands a little over a month after Copy Fail (CVE-2026-31431), the page-cache root flaw that prompted CISA to add an emergency patch deadline of May 15, 2026 for federal agencies, as previously reported.
What We Know
Dirty Frag was reported to Linux kernel maintainers by security researcher Hyunwoo Kim on April 30, 2026, according to The Hacker News. The coordinated disclosure window collapsed on May 7, when an unrelated third party independently published a working exploit for the IPsec component, BleepingComputer reported. Kim then released full Dirty Frag documentation and a proof-of-concept on May 8 with the agreement of distribution maintainers, BleepingComputer wrote.
The two underlying flaws sit in different parts of the networking stack. CVE-2026-43284 is the xfrm-ESP Page-Cache Write bug, rooted in the kernel’s IPsec subsystem; CVE-2026-43500 is the RxRPC Page-Cache Write bug, in the rxrpc module that supports the Andrew File System, according to The Hacker News. Tenable’s analysis describes the chain in operational terms: xfrm-ESP gives an attacker a 4-byte store primitive, and rxrpc supplies the namespace creation needed to weaponize it, Tenable wrote. Canonical assessed both modules as carrying a CVSS 3.1 base score of 7.8, corresponding to a severity of HIGH, according to Ubuntu.
The distribution coverage is broad. Tenable lists Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44 among the confirmed-vulnerable kernels, Tenable noted. Canonical’s own advisory enumerates Ubuntu releases from Trusty Tahr (14.04 LTS) through Resolute Raccoon (26.04 LTS) as impacted, according to Ubuntu. The Hacker News framed the lineage of the bug class succinctly: “Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong,” The Hacker News reported.
Reliability is the headline operational fact. Where many kernel exploits have to win a race, Dirty Frag does not: “Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required,” The Hacker News wrote.
Microsoft’s threat-intelligence team published a parallel advisory on May 8 saying its Defender telemetry had detected limited in-the-wild activity consistent with Dirty Frag or Copy Fail exploitation, including privilege escalation involving the su command, according to Microsoft. Microsoft summarized the bug in similar terms to the upstream advisories: “Dirty Frag abuses Linux kernel networking and memory-fragment handling behavior involving esp4, esp6, and rxrpc components,” Microsoft wrote.
Patch status is split. Microsoft’s advisory says CVE-2026-43284, the IPsec ESP variant, was patched in mainline Linux on May 8, while CVE-2026-43500, the rxrpc variant, had no patches available as of that publication date, according to Microsoft. Canonical’s mitigation guidance leans on three steps: blocklisting the affected modules via a /etc/modprobe.d/ configuration file, unloading them at runtime, and confirming successful removal; “Once kernel updates are available and installed, the mitigation can be removed,” Ubuntu wrote.
What We Don’t Know
CVE-2026-43500 — the rxrpc half — remained unpatched in mainline Linux at the time of the public advisories, according to Microsoft. Tenable’s FAQ noted that the rxrpc CVE had not been assigned a CVSS score as of publication, Tenable wrote. The full scope of in-the-wild exploitation is also still unclear: Microsoft characterized the activity its Defender team observed as limited and ambiguous between Dirty Frag and Copy Fail signatures, according to Microsoft. The identity of the third party that broke the embargo on May 7 has not been publicly disclosed, BleepingComputer reported.
Analysis
If Copy Fail showed how a single page-cache logic bug could compromise nine years of Linux deployments, Dirty Frag shows that the underlying class — page-cache write primitives reachable from networking subsystems — is wider than initially understood. Canonical’s CVSS 7.8 rating and Microsoft’s same-day detection both indicate operational urgency; the half-patched mainline as of disclosure means defenders are leaning on module blocklists rather than kernel updates for the rxrpc side. With deterministic exploitation and a public proof-of-concept already in circulation, the next several weeks of patch deployment will be a stress test for the same Linux distribution maintainers who are still shipping Copy Fail backports.