Dirty Frag (CVE-2026-43284 and CVE-2026-43500) is a local privilege escalation vulnerability in the Linux kernel that chains two flaws in the xfrm-ESP (IPsec) and RxRPC components. It allows an unprivileged user to gain root privileges without relying on timing or race conditions, making exploitation highly reliable. The vulnerability was disclosed prematurely before patches were available, leading to public release of technical details and proof-of-concept code. It primarily affects hosts not running container workloads but may also enable container escapes. Limited exploitation activity has been observed, including modification of authentication files and session disruption. Major Linux distributions have begun releasing patches and mitigations. The vulnerability is related to prior Linux kernel issues such as Dirty Pipe and Copy Fail, which have also been exploited in the wild.

Successful exploitation of Dirty Frag allows an unprivileged local attacker to escalate privileges to root on affected Linux systems. This can lead to full system compromise, including modification of authentication files and disruption or access of active PHP sessions. The vulnerability may also enable container escape, increasing risk in containerized environments, although this has not yet been demonstrated. Limited exploitation activity has been observed in the wild, indicating active threat. The vulnerability affects major Linux distributions and could be leveraged after an attacker gains initial access via compromised accounts or other means.

Linux distributions including Red Hat, Amazon Linux, Ubuntu, Fedora, and Alma Linux have started releasing patches and mitigations for Dirty Frag. Users and administrators should apply these official patches promptly to remediate the vulnerability. Since the vulnerability was disclosed before patches were available, immediate patching is critical. Microsoft Defender has detected limited exploitation attempts, so monitoring for related indicators may be useful. No vendor advisory states that no action is required or that the issue is already mitigated without patching. Patch status is confirmed as official fixes being released by major vendors.