# Dirty Frag is a Linux kernel privilege escalation vulnerability affecting versions 4.10+…

Published: 2026-05-20 · Severity: high
Canonical: https://vorant.io/reports/229a0254-db3f-451e-b3f6-e701e160ecb5/dirty-frag-is-a-linux-kernel-privilege-escalation-vulnerability-affecting

> Dirty Frag is a Linux kernel privilege escalation vulnerability affecting versions 4.10+ via IPv4/IPv6 fragmentation flaws, publicly disclosed May 7, 2026.

A privilege escalation vulnerability nicknamed 'Dirty Frag' affects Linux kernel versions 4.10 and later, targeting the IPv4/IPv6 fragmentation and reassembly subsystem. The vulnerability chains two previously discovered flaws (CVE-2026-43284 and CVE-2026-43500) and stems from improper handling of overlapping or malformed fragment offsets during packet reassembly. Attackers can send crafted network packets to trigger memory corruption conditions through insufficient validation of fragment metadata, including incomplete boundary checks and acceptance of overlapping fragments in unsafe sequences.

Successful exploitation can result in local or remote denial of service through kernel panic, memory corruption within the Linux networking stack, privilege escalation, and potential container escape in containerized environments. The vulnerability may also provide primitives for more advanced memory manipulation when chained with other exploits. Mitigation strategies include patching to vendor-released kernel updates, disabling vulnerable modules (esp4, esp6, rxrpc), using initcall blacklisting for built-in modules, and implementing container-specific controls through seccomp filtering, AppArmor policies, or eBPF-based enforcement to restrict AF_ALG and AF_RXRPC socket creation.

## Mentioned in this report

- Vulnerabilities: CVE-2026-43284 (weaponized), CVE-2026-43500 (weaponized)

## Detection guidance (public sample)

### Suspicious Loading of Fragment-Handling Kernel Modules (esp4/esp6/rxrpc)

ATT&CK: T1068

Detects manual loading of esp4, esp6, or rxrpc kernel modules via modprobe/insmod, which are the modules implicated in the Dirty Frag IPv4/IPv6 fragmentation reassembly vulnerability chain (CVE-2026-43284/CVE-2026-43500). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Loading of Fragment-Handling Kernel Modules
id: a358d08a-affd-567a-a099-95bd7c82d70d
status: experimental
description: 'Detects modprobe/insmod invocations loading esp4, esp6, or rxrpc kernel
  modules.

  These modules are directly implicated in the ''Dirty Frag'' Linux kernel fragmentation

  reassembly vulnerability (CVE-2026-43284/CVE-2026-43500) used for privilege escalation

  and container escape. Legitimate loading of these modules is uncommon outside of

  IPsec/AFS-related configuration, so unexpected loads warrant investigation.

  '
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
    - /modprobe
    - /insmod
    CommandLine|contains:
    - esp4
    - esp6
    - rxrpc
  condition: selection
falsepositives:
- Legitimate IPsec (esp4/esp6) configuration on VPN gateways
- AFS/Kerberos-related rxrpc module usage on file servers
level: medium
```

### AF_ALG or AF_RXRPC Socket Creation via Syscall Audit

ATT&CK: T1068

Detects processes creating AF_ALG or AF_RXRPC family sockets, which are the socket types abused to reach the vulnerable fragmentation reassembly code path exploited by Dirty Frag. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: AF_ALG or AF_RXRPC Socket Creation via Syscall Audit
id: 6766a30e-63f4-5c79-a998-0898d60e8f18
status: experimental
description: 'Detects socket() syscalls requesting the AF_ALG or AF_RXRPC address
  families.

  Mitigation guidance for the Dirty Frag vulnerability explicitly recommends

  restricting creation of these socket types via seccomp/AppArmor/eBPF, indicating

  they are the primary vector used to reach the vulnerable fragmentation code.

  Unexpected creation of these sockets by non-system processes, especially inside

  containers, may indicate exploitation attempts.

  '
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.t1611
- attack.privilege-escalation
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    syscall: socket
    a0:
    - '0x26'
    - '38'
    - '0x21'
    - '33'
  condition: selection
falsepositives:
- Kerberos/AFS client software legitimately using AF_RXRPC
- Cryptographic applications using the kernel crypto API (AF_ALG) for hardware-accelerated
  ciphers
level: medium
```

### Kernel Panic or Oops Referencing Fragment Reassembly Code Paths

ATT&CK: T1611

Detects kernel log messages indicating a crash or oops originating in IPv4/IPv6 fragment reassembly functions, consistent with a failed or successful Dirty Frag exploitation attempt causing memory corruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Kernel Panic or Oops Referencing Fragment Reassembly Code Paths
id: 8a6eb954-86e4-5b48-b1ee-f33a831e68af
status: experimental
description: 'Detects kernel log entries containing panic/oops/BUG indicators alongside

  references to IP fragment reassembly functions (ip_frag, ip6_frag, reasm,

  skb_segment, esp_input) consistent with exploitation of the Dirty Frag

  fragmentation reassembly vulnerability. A crash during exploitation attempts

  is common due to the fragility of memory corruption primitives.

  '
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1611
- attack.t1068
logsource:
  product: linux
  service: syslog
detection:
  selection_crash:
    Message|contains:
    - Kernel panic
    - general protection fault
    - 'BUG: KASAN'
    - 'Oops:'
  selection_context:
    Message|contains:
    - ip_frag
    - ip6_frag
    - reasm
    - skb_segment
    - esp_input
    - frag_reasm
  condition: selection_crash and selection_context
falsepositives:
- Legitimate kernel bugs unrelated to Dirty Frag triggered by malformed traffic from
  misconfigured network gear
- Fuzzing or kernel testing activity in QA environments
level: high
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://kb.cert.org/vuls/id/980487

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/229a0254-db3f-451e-b3f6-e701e160ecb5/dirty-frag-is-a-linux-kernel-privilege-escalation-vulnerability-affecting.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup