Dirty Frag is a Linux kernel privilege escalation vulnerability affecting versions 4.10+…
Dirty Frag is a Linux kernel privilege escalation vulnerability affecting versions 4.10+ via IPv4/IPv6 fragmentation flaws, publicly disclosed May 7, 2026.
A privilege escalation vulnerability nicknamed 'Dirty Frag' affects Linux kernel versions 4.10 and later, targeting the IPv4/IPv6 fragmentation and reassembly subsystem. The vulnerability chains two previously discovered flaws (CVE-2026-43284 and CVE-2026-43500) and stems from improper handling of overlapping or malformed fragment offsets during packet reassembly. Attackers can send crafted network packets to trigger memory corruption conditions through insufficient validation of fragment metadata, including incomplete boundary checks and acceptance of overlapping fragments in unsafe sequences.
Successful exploitation can result in local or remote denial of service through kernel panic, memory corruption within the Linux networking stack, privilege escalation, and potential container escape in containerized environments. The vulnerability may also provide primitives for more advanced memory manipulation when chained with other exploits. Mitigation strategies include patching to vendor-released kernel updates, disabling vulnerable modules (esp4, esp6, rxrpc), using initcall blacklisting for built-in modules, and implementing container-specific controls through seccomp filtering, AppArmor policies, or eBPF-based enforcement to restrict AF_ALG and AF_RXRPC socket creation.
Mentioned in this report
Detection guidance
Suspicious Loading of Fragment-Handling Kernel Modules (esp4/esp6/rxrpc)
Detects manual loading of esp4, esp6, or rxrpc kernel modules via modprobe/insmod, which are the modules implicated in the Dirty Frag IPv4/IPv6 fragmentation reassembly vulnerability chain (CVE-2026-43284/CVE-2026-43500). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Loading of Fragment-Handling Kernel Modules
id: a358d08a-affd-567a-a099-95bd7c82d70d
status: experimental
description: 'Detects modprobe/insmod invocations loading esp4, esp6, or rxrpc kernel
modules.
These modules are directly implicated in the ''Dirty Frag'' Linux kernel fragmentation
reassembly vulnerability (CVE-2026-43284/CVE-2026-43500) used for privilege escalation
and container escape. Legitimate loading of these modules is uncommon outside of
IPsec/AFS-related configuration, so unexpected loads warrant investigation.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /modprobe
- /insmod
CommandLine|contains:
- esp4
- esp6
- rxrpc
condition: selection
falsepositives:
- Legitimate IPsec (esp4/esp6) configuration on VPN gateways
- AFS/Kerberos-related rxrpc module usage on file servers
level: medium
AF_ALG or AF_RXRPC Socket Creation via Syscall Audit
Detects processes creating AF_ALG or AF_RXRPC family sockets, which are the socket types abused to reach the vulnerable fragmentation reassembly code path exploited by Dirty Frag. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AF_ALG or AF_RXRPC Socket Creation via Syscall Audit
id: 6766a30e-63f4-5c79-a998-0898d60e8f18
status: experimental
description: 'Detects socket() syscalls requesting the AF_ALG or AF_RXRPC address
families.
Mitigation guidance for the Dirty Frag vulnerability explicitly recommends
restricting creation of these socket types via seccomp/AppArmor/eBPF, indicating
they are the primary vector used to reach the vulnerable fragmentation code.
Unexpected creation of these sockets by non-system processes, especially inside
containers, may indicate exploitation attempts.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.t1611
- attack.privilege-escalation
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
syscall: socket
a0:
- '0x26'
- '38'
- '0x21'
- '33'
condition: selection
falsepositives:
- Kerberos/AFS client software legitimately using AF_RXRPC
- Cryptographic applications using the kernel crypto API (AF_ALG) for hardware-accelerated
ciphers
level: medium
Kernel Panic or Oops Referencing Fragment Reassembly Code Paths
Detects kernel log messages indicating a crash or oops originating in IPv4/IPv6 fragment reassembly functions, consistent with a failed or successful Dirty Frag exploitation attempt causing memory corruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Panic or Oops Referencing Fragment Reassembly Code Paths
id: 8a6eb954-86e4-5b48-b1ee-f33a831e68af
status: experimental
description: 'Detects kernel log entries containing panic/oops/BUG indicators alongside
references to IP fragment reassembly functions (ip_frag, ip6_frag, reasm,
skb_segment, esp_input) consistent with exploitation of the Dirty Frag
fragmentation reassembly vulnerability. A crash during exploitation attempts
is common due to the fragility of memory corruption primitives.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1611
- attack.t1068
logsource:
product: linux
service: syslog
detection:
selection_crash:
Message|contains:
- Kernel panic
- general protection fault
- 'BUG: KASAN'
- 'Oops:'
selection_context:
Message|contains:
- ip_frag
- ip6_frag
- reasm
- skb_segment
- esp_input
- frag_reasm
condition: selection_crash and selection_context
falsepositives:
- Legitimate kernel bugs unrelated to Dirty Frag triggered by malformed traffic from
misconfigured network gear
- Fuzzing or kernel testing activity in QA environments
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/980487
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free