CVE-2026-43284
xfrm: esp: avoid in-place decrypt on shared skb frags
Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().
INFO
Published Date :
May 8, 2026, 8:16 a.m.
Last Modified :
May 26, 2026, 6:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 134c704f-9b21-4f2e-91b3-4a467353bcc0 | ||||
| CVSS 3.1 | HIGH | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 |
Solution
- Update the Linux kernel to the latest patched version.
- Apply the provided security patches for xfrm:esp.
- Ensure shared fragments are marked correctly.
- Validate ESP input fallback to COW.
Public PoC/Exploit Available at Github
CVE-2026-43284 has a 143 public
PoC/Exploit available at Github.
Go to the Public Exploits tab to see the list.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-43284.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-43284 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-43284
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
A dynamically growing portfolio of practical cybersecurity labs covering SOC operations, penetration testing, and real-world vulnerability mitigation.
Automated AWS network exposure analysis for BOD 26-04 compliance using VPC Network Access Analyzer and Boto3
Python Shell
Local Linux CLI collector for Dirty Frag evidence and package inventory
Makefile C Python
Go-based Scanner for several 2025-2026 Linux root kernel vulnerabilities (DirtyFrag, Fragnesia, Copy Fail, Fragnesia, DirtyPipe)
Makefile Go
This repository contains a lab validation report and detection artefacts for DirtyFrag CVE-2026-43284, a Linux local privilege escalation issue related to the XFRM/ESP page-cache write path. The focus is on auditd telemetry, event correlation, and SOC-oriented detection logic.
Shell
DEU univ. 2026 spring semester report
C Shell PHP
Script to check if system are vulnable to cve-2026-23111
Shell
Free read-only container escape and Kubernetes security audit. 23 checks covering privileged mode, capabilities, namespace isolation, runtime sockets, service accounts, cloud IMDS and kubelet API. JSON output, CI/CD ready. Pro version (47 checks + CVE engine) on Capafy.
Shell
None
Makefile C
None
CMake Makefile C
Add go CVE-2026-43284 / CVE-2026-43500 (dirtyfrag) local privilege escalation exploit
Go
Herramienta de análisis pasivo para detectar exposición de Copy-Fail, Dirty Frag y Fragnesia en sistemas Linux.
Shell
old traitor with new exploits
Go C
None
HTML Python C
Personal fork of Joshua-Riek/ubuntu-rockchip image builder for Orange Pi 5B
arm64 orangepi orangepi5b rk3588 rockchip ubuntu securitypatches
Shell Makefile
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-43284 vulnerability anywhere in the article.
-
The Hacker News
Researchers Build Self-Replicating AI Worm That Operates Entirely on Local, Open-Weight Models
University of Toronto researchers have built and tested a proof-of-concept AI-driven computer worm that uses a locally hosted open-weight large language model to reason its way through a network, gene ... Read more
-
europa.eu
Cyber Brief 26-06 - May 2026
Cyber Brief (May 2026)June 2, 2026 - Version: 1TLP:CLEARExecutive summaryWe analysed 325 open source reports for this Cyber Brief1.Relating to cyber policy and law enforcement, Europol supported inter ... Read more
-
CybersecurityNews
GitHub Enterprise Server 3.20.3 Released With Fox for Critical Vulnerabilities
GitHub has shipped GitHub Enterprise Server (GHES) 3.20.3 as a security‑driven patch release that fixes multiple critical and high‑severity vulnerabilities and rotates the signing key used to validate ... Read more
-
CybersecurityNews
Multiple cPanel Vulnerabilities Allows Access to Sensitive System Resources
In a severe blow to web hosting environments worldwide, administrators are racing against the clock to patch a massive wave of security vulnerabilities affecting cPanel and WebHost Manager (WHM). Thre ... Read more
-
Ars Technica
Linux bitten by second severe vulnerability in as many weeks
Both privilege escalation vulnerabilities stem from bugs in the kernel’s handling of page caches stored in memory, allowing untrusted users to modify them. They target caches in networking and memory- ... Read more
-
security.nl
Veel QNAP NAS-systemen kwetsbaar voor Linux Dirty Frag-lek
Veel NAS-systemen van fabrikant QNAP zijn kwetsbaar voor het Linux Dirty Frag-lek. Een beveiligingsupdate is echter nog niet beschikbaar. Dirty Frag combineert twee verschillende kernel-kwetsbaarheden ... Read more
The following table lists the changes that have been made to the
CVE-2026-43284 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 26, 2026
Action Type Old Value New Value Added Reference https://www.vicarius.io/vsociety/posts/cve-2026-43284-detection-script-dirty-frag-linux-kernel-local-privilege-escalation Added Reference https://www.vicarius.io/vsociety/posts/cve-2026-43284-mitigation-script-dirty-frag-linux-kernel-local-privilege-escalation -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 14, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/14/4 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 14, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/14/2 -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 13, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/13/6 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 11, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H Removed CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-123 Removed CWE CWE-416 -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7 Added Reference https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad -
Initial Analysis by [email protected]
May. 08, 2026
Action Type Old Value New Value Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.11 up to (excluding) 5.10.255 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.12 up to (excluding) 5.15.205 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.1.171 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.13 up to (excluding) 6.18.28 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.2 up to (excluding) 6.6.138 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 6.7 up to (excluding) 6.12.87 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 7.0 up to (excluding) 7.0.5 Added Reference Type CVE: http://www.openwall.com/lists/oss-security/2026/05/08/7 Types: Mailing List Added Reference Type kernel.org: https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d Types: Patch Added Reference Type CISA-ADP: https://github.com/V4bel/dirtyfrag Types: Exploit, Third Party Advisory -
CVE Modified by 134c704f-9b21-4f2e-91b3-4a467353bcc0
May. 08, 2026
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Added CWE CWE-416 Added Reference https://github.com/V4bel/dirtyfrag -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec Added Reference https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9 Added Reference https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
May. 08, 2026
Action Type Old Value New Value Added Reference http://www.openwall.com/lists/oss-security/2026/05/08/7 -
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 08, 2026
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data(). Added Reference https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03 Added Reference https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034 Added Reference https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97 Added Reference https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d