Linux kernel IPv4/IPv6 fragmentation privilege escalation flaw
Dirty Frag is a Linux kernel privilege escalation vulnerability affecting versions 4.10+ via IPv4/IPv6 fragmentation flaws, publicly disclosed May 7, 2026.
Sourcekb.cert.org — open the original
What to check
- Applies to
- The 2 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- A public exploit is recorded for CVE-2026-43284 (weaponized) and CVE-2026-43500 (weaponized); no exploitation in the wild is recorded.
A privilege escalation vulnerability nicknamed 'Dirty Frag' affects Linux kernel versions 4.10 and later, targeting the IPv4/IPv6 fragmentation and reassembly subsystem. The vulnerability chains two previously discovered flaws (CVE-2026-43284 and CVE-2026-43500) and stems from improper handling of overlapping or malformed fragment offsets during packet reassembly. Attackers can send crafted network packets to trigger memory corruption conditions through insufficient validation of fragment metadata, including incomplete boundary checks and acceptance of overlapping fragments in unsafe sequences.
Successful exploitation can result in local or remote denial of service through kernel panic, memory corruption within the Linux networking stack, privilege escalation, and potential container escape in containerized environments. The vulnerability may also provide primitives for more advanced memory manipulation when chained with other exploits. Mitigation strategies include patching to vendor-released kernel updates, disabling vulnerable modules (esp4, esp6, rxrpc), using initcall blacklisting for built-in modules, and implementing container-specific controls through seccomp filtering, AppArmor policies, or eBPF-based enforcement to restrict AF_ALG and AF_RXRPC socket creation.
Mentioned in this report
Detection guidance
Suspicious Loading of Fragment-Handling Kernel Modules (esp4/esp6/rxrpc)
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects manual loading of esp4, esp6, or rxrpc kernel modules via modprobe/insmod, which are the modules implicated in the Dirty Frag IPv4/IPv6 fragmentation reassembly vulnerability chain (CVE-2026-43284/CVE-2026-43500). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Loading of Fragment-Handling Kernel Modules
id: a358d08a-affd-567a-a099-95bd7c82d70d
status: experimental
description: 'Detects modprobe/insmod invocations loading esp4, esp6, or rxrpc kernel
modules.
These modules are directly implicated in the ''Dirty Frag'' Linux kernel fragmentation
reassembly vulnerability (CVE-2026-43284/CVE-2026-43500) used for privilege escalation
and container escape. Legitimate loading of these modules is uncommon outside of
IPsec/AFS-related configuration, so unexpected loads warrant investigation.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.privilege-escalation
logsource:
category: process_creation
product: linux
detection:
selection:
Image|endswith:
- /modprobe
- /insmod
CommandLine|contains:
- esp4
- esp6
- rxrpc
condition: selection
falsepositives:
- Legitimate IPsec (esp4/esp6) configuration on VPN gateways
- AFS/Kerberos-related rxrpc module usage on file servers
level: medium
AF_ALG or AF_RXRPC Socket Creation via Syscall Audit
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects processes creating AF_ALG or AF_RXRPC family sockets, which are the socket types abused to reach the vulnerable fragmentation reassembly code path exploited by Dirty Frag. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: AF_ALG or AF_RXRPC Socket Creation via Syscall Audit
id: 6766a30e-63f4-5c79-a998-0898d60e8f18
status: experimental
description: 'Detects socket() syscalls requesting the AF_ALG or AF_RXRPC address
families.
Mitigation guidance for the Dirty Frag vulnerability explicitly recommends
restricting creation of these socket types via seccomp/AppArmor/eBPF, indicating
they are the primary vector used to reach the vulnerable fragmentation code.
Unexpected creation of these sockets by non-system processes, especially inside
containers, may indicate exploitation attempts.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1068
- attack.t1611
- attack.privilege-escalation
logsource:
product: linux
service: auditd
detection:
selection:
type: SYSCALL
syscall: socket
a0:
- '0x26'
- '38'
- '0x21'
- '33'
condition: selection
falsepositives:
- Kerberos/AFS client software legitimately using AF_RXRPC
- Cryptographic applications using the kernel crypto API (AF_ALG) for hardware-accelerated
ciphers
level: medium
Kernel Panic or Oops Referencing Fragment Reassembly Code Paths
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
Detects kernel log messages indicating a crash or oops originating in IPv4/IPv6 fragment reassembly functions, consistent with a failed or successful Dirty Frag exploitation attempt causing memory corruption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Kernel Panic or Oops Referencing Fragment Reassembly Code Paths
id: 8a6eb954-86e4-5b48-b1ee-f33a831e68af
status: experimental
description: 'Detects kernel log entries containing panic/oops/BUG indicators alongside
references to IP fragment reassembly functions (ip_frag, ip6_frag, reasm,
skb_segment, esp_input) consistent with exploitation of the Dirty Frag
fragmentation reassembly vulnerability. A crash during exploitation attempts
is common due to the fragility of memory corruption primitives.
'
references:
- Dirty Frag Linux kernel privilege escalation report
author: Vorant
tags:
- attack.t1611
- attack.t1068
logsource:
product: linux
service: syslog
detection:
selection_crash:
Message|contains:
- Kernel panic
- general protection fault
- 'BUG: KASAN'
- 'Oops:'
selection_context:
Message|contains:
- ip_frag
- ip6_frag
- reasm
- skb_segment
- esp_input
- frag_reasm
condition: selection_crash and selection_context
falsepositives:
- Legitimate kernel bugs unrelated to Dirty Frag triggered by malformed traffic from
misconfigured network gear
- Fuzzing or kernel testing activity in QA environments
level: high
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://kb.cert.org/vuls/id/980487
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs