"Dirty Frag-CVE-2026-43284 and CVE-2026-43500
"Dirty Frag" is a highly reliable Linux kernel privilege escalation vulnerability that exploits logical defects in the splice system calls combined with the xfrm-ESP or RxRPC protocol stacks. By executing these flaws, local attackers can tamper with the page cache of read-only files (such as /etc/passwd or /usr/bin/su) to gain root privileges or execute container escapes without relying on race conditions. These vulnerabilities are particularly dangerous for defenders because they manipulate memory data (page cache) without permanently altering the underlying disk files, rendering traditional disk-based file integrity monitoring tools ineffective at detecting the exploit in real-time. Affected Linux Kernel Module: ESP (IPsec) modules esp4 esp6 2. RxRPC module Linux kernel module for: Remote procedure calls (AF_RXRPC protocol)
Microsoft Sentinel (KQL)
