CVE-2026-43284
xfrm: esp: avoid in-place decrypt on shared skb frags
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().
INFO
Published Date :
May 8, 2026, 8:16 a.m.
Last Modified :
May 26, 2026, 6:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest patched version.
- Apply the provided security patches for xfrm:esp.
- Ensure shared fragments are marked correctly.
- Validate ESP input fallback to COW.
Public PoC/Exploit Available at Github
CVE-2026-43284 has a 105 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43284.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43284 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43284
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Linux page-cache injector for cross-container escape. Multiple kernel write primitives
Makefile C Shell Assembly
None
Lab detection exercise for DirtyFrag (CVE-2026-43284) - Linux kernel privilege escalation via xfrm-ESP page cache corruption. Full write-up covering exploit execution, detection gaps, and corrected EQL rules using Elastic Stack
None
C
Reproducible isolated lab for verifying Inner Warden's detection of public Linux kernel CVEs. Clone, follow the per-CVE recipe, watch the autonomous agent react on your own VM.
Shell
CachyOS Based Hardened Linux kernel with Rust FFI security hooks - blocks page-cache write vulnerabilities by calling Rust from C at the syscall boundary. Also we add extra optional patches.
Makefile Rust Shell C
None
A collection of CVE reproductions with proof-of-concept code, technical analyses, and detailed write-ups. For defensive research and educational purposes.
Python Java Ruby Shell Dockerfile PHP C
Vagrant VMs with known CVEs for exploit testing
Multi-architecture Linux privilege escalation toolkit with 18 pre-built and runtime-compilable exploits. Auto-detects kernel version, filters patched exploits, tries each until root.
ctf cybersecurity exploit gtfobins kernel-exploit linux penetration-testing privilege-escalation security
Makefile Shell C Go
Патч-скрипты для устранения критических уязвимостей (Copy Fail, Dirty Frag) в РЕД ОС 7.3 и 8.0
Shell
A Go implementation of dirtydecrypt (CVE-2026-31635)
Go
无交互式的 dirtyfrag
C
None
A Go implementation of fragnesia (CVE-2026-46300)
Go
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43284 vulnerability anywhere in the article.
-
CybersecurityNews
GitHub Enterprise Server 3.20.3 Released With Fox for Critical Vulnerabilities
GitHub has shipped GitHub Enterprise Server (GHES) 3.20.3 as a security‑driven patch release that fixes multiple critical and high‑severity vulnerabilities and rotates the signing key used to validate ... Read more
-
CybersecurityNews
Multiple cPanel Vulnerabilities Allows Access to Sensitive System Resources
In a severe blow to web hosting environments worldwide, administrators are racing against the clock to patch a massive wave of security vulnerabilities affecting cPanel and WebHost Manager (WHM). Thre ... Read more
-
Ars Technica
Linux bitten by second severe vulnerability in as many weeks
Both privilege escalation vulnerabilities stem from bugs in the kernel’s handling of page caches stored in memory, allowing untrusted users to modify them. They target caches in networking and memory- ... Read more
-
security.nl
Veel QNAP NAS-systemen kwetsbaar voor Linux Dirty Frag-lek
Veel NAS-systemen van fabrikant QNAP zijn kwetsbaar voor het Linux Dirty Frag-lek. Een beveiligingsupdate is echter nog niet beschikbaar. Dirty Frag combineert twee verschillende kernel-kwetsbaarheden ... Read more
The following table lists the changes that have been made to the
CVE-2026-43284 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 26, 2026
Action Type Old Value New Value Added Reference https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation Added Reference https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 14, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/14/4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 14, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/14/2 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 13, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/13/6 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Removed CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-123 Removed CWE CWE-416 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7 Added Reference https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad -
Initial Analysis by [email protected]
May. 08, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.11 up to (excluding) 5.10.255 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12 up to (excluding) 5.15.205 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.171 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.28 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.138 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.87 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (excluding) 7.0.5 Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/05/08/7 Types: Mailing List Added Reference Type kernel.org: https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d Types: Patch Added Reference Type CISA-ADP: https://github.com/V4bel/dirtyfrag Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 Added Reference https://github.com/V4bel/dirtyfrag -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec Added Reference https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9 Added Reference https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 08, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/08/7 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). Added Reference https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03 Added Reference https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034 Added Reference https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97 Added Reference https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d