Two container breakout vulnerabilities, CVE-2026-43284 and CVE-2026-43500, collectively known as DirtyFrag, have been discovered in the Linux kernel. They enable an unprivileged local attacker to escalate privileges to root on the host system. The rxrpc exploit path (CVE-2026-43500) affects Ubuntu nodes but not Container-Optimized OS, while the esp4 exploit path (CVE-2026-43284) affects both but is mitigated in GKE clusters using default seccomp profiles or GKE Sandbox. Containers granting CAP_NET_ADMIN and allowing the unshare syscall are vulnerable. Red Hat OpenShift Container Platform 4.20.22 includes fixes for these vulnerabilities. The vulnerabilities have a CVSS 3.1 base score of 7.8, indicating high severity. Red Hat recommends upgrading to the patched version and applying security context settings to reduce risk.

These vulnerabilities allow local unprivileged attackers to escalate privileges to root on the host, potentially compromising the entire system. The impact includes full confidentiality, integrity, and availability loss (CVSS: C:H/I:H/A:H). The vulnerabilities affect containerized environments, enabling container breakout attacks. The severity is high, and exploitation requires local access with certain syscall capabilities depending on the exploit path.

Red Hat has released OpenShift Container Platform 4.20.22 which includes fixes for these vulnerabilities. Users should upgrade to version 4.20.22 or later using the OpenShift CLI or web console. Additional mitigations include running containers as non-root, using the RuntimeDefault seccomp profile to block the unshare syscall, and setting allowPrivilegeEscalation to false in container security contexts. For GKE users, upgrading Container-Optimized OS node pools to specified patched versions is recommended. Use of GKE Sandbox is advised as a strong mitigation. Do not rely solely on containers as security boundaries.