Dirty Frag: Risky New Linux Bug

🔑 Enhanced Key Takeaways

• •Dirty Frag is a deterministic local privilege escalation (LPE) chain consisting of two distinct vulnerabilities (CVE-2026-43284 and CVE-2026-43500) that exploit unsafe in-place cryptographic processing within the Linux kernel's ESP (IPsec) and RxRPC networking subsystems.
• •The vulnerability exploits the kernel's zero-copy mechanisms (splice/vmsplice) to corrupt file-backed pages in the page cache, allowing an unprivileged user to modify sensitive files like /etc/passwd or /usr/bin/su in memory without altering the original files on disk, effectively bypassing traditional file-integrity monitoring.
• •The coordinated disclosure process collapsed on May 7, 2026, when an unrelated third party published exploit code, forcing researcher Hyunwoo Kim to release full documentation before official patches were widely available for all affected distributions.

🛠️ Technical Deep Dive

• •Vulnerability Class: Memory-manipulation flaw affecting the frag member of struct sk_buff (socket buffers).
• •Exploit Mechanism: Abuses zero-copy/splice() performance paths in esp_input and rxkad_verify_packet_1 to perform in-place decryption over paged buffers not privately owned by the kernel.
• •CVE-2026-43284 (ESP): Provides a 4-byte STORE primitive by manipulating the seq_hi (high-order sequence number) in an XFRM Security Association.
• •CVE-2026-43500 (RxRPC): Provides an 8-byte STORE primitive resulting from fcrypt decryption, allowing for complex memory corruption without requiring user namespaces.
• •Persistence: The corrupted page cache persists until the system reboots or the cache is explicitly cleared using 'echo 3 > /proc/sys/vm/drop_caches'.

🔮 Future ImplicationsAI analysis grounded in cited sources

⏳ Timeline