Dirty Frag: The Linux Kernel LPE That Succeeds Where Copy Fail's Mitigation Stops
Overview Attribute Value CVE (ESP variant) CVE-2026-43284 CVE (RxRPC variant) CVE-2026-43500 (reserved, no patch yet) Name Dirty Frag Type Local Privilege Escalation (LPE) Affected Ubuntu 24.04, RHEL 10.1, CentOS Stream 10, AlmaLinux 10, Fedora 44, openSUSE Tumbleweed — effectively all major distros Effective Lifetime ~9 years (xfrm-ESP since 2017, RxRPC since 2023) Race Condition None — deterministic Researcher Hyunwoo Kim (@v4bel) PoC ✅ Public (github.com/V4bel/dirtyfrag) ESP Patch ✅ Merged to mainline (f4c50a4034e6) RxRPC Patch ❌ No patch in any tree yet What Is Dirty Frag? Dirty Frag is a vulnerability class — not a single bug — that extends the same lineage as Dirty Pipe (CVE-2022-0847) and Copy Fail (CVE-2026-31431). Where Dirty Pipe overwrites struct pipe_buffer and Copy Fail overwrites the AF_ALG scatterlist, Dirty Frag overwrites the frag member of struct sk_buff. ...