Dirty Frag (CVE-2026-43284, CVE-2026-43500): KernelCare Live Patches Released

Go straight to an AI summary of this blog post instead

A week after Copy Fail (CVE-2026-31431), researcher Hyunwoo Kim disclosed a second Linux kernel local privilege escalation in the same broad area, IPsec ESP and rxrpc, and named it Dirty Frag. A working public proof-of-concept exists. Any unprivileged local user can use it to gain root in a single command.

KernelCare engineering shipped live patches for the entire EL8 kernel family within 24 hours of disclosure, ahead of the corresponding vendor erratas, with EL9, Ubuntu, Debian, and Proxmox VE following on the same release wave. The patch applies to the running kernel and takes effect without a reboot.

A second public exploit named “Copy Fail 2: Electric Boogaloo” refers to this same vulnerability under that alias. There is no separate “Copy Fail 2” CVE. Everything in this advisory applies.

Background: public PoC and write-up · oss-security disclosure · NVD entry for CVE-2026-43284 · Upstream fix

Why this is urgent

The flaw is in the in-place decryption path of esp4, esp6, and rxrpc. When the receive path decrypts over paged buffers not privately owned by the kernel (for example, pipe pages reaching the socket via splice(2) / sendfile(2)), unprivileged processes can retain references to the resulting plaintext, yielding a write primitive into the page cache that the public PoC turns into root in a single command.

The responsible-disclosure embargo was broken on 2026-05-07 before distributions could coordinate. A working exploit went public before CVE IDs were assigned and before vendor erratas were ready. On any system where untrusted users can execute code, this should be treated as a same-day patching event.

Update on CVE assignments:

The xfrm-ESP page-cache write vulnerability is tracked as CVE-2026-43284.
The rxrpc page-cache write vulnerability is reserved as CVE-2026-43500 (NVD entry pending).

KernelCare live patches: available now, no reboot

KernelCare delivered live patches ahead of vendor erratas across the supported distributions:

EL8 family (RHEL 8, CentOS 8, Oracle Linux 8, CloudLinux 8, CloudLinux 7 Hybrid, AlmaLinux 8, Rocky Linux 8)
EL9 family (RHEL 9, AlmaLinux 9, Oracle Linux 9, Rocky Linux 9)
Ubuntu 22.04 LTS (Jammy), including AWS and HWE variants
Debian 12 (Bookworm)
Proxmox VE 7 (5.15 kernel) and Proxmox VE 8

Customers receive the fix automatically on their next kcarectl –update.

ELS for FIPS kernels are also covered

TuxCare’s Endless Lifecycle Support FIPS-validated kernels for AlmaLinux 9.2 and 9.6 are patched. ELS-FIPS customers receive the fix through the same KernelCare delivery channel (releases K20260508_20 and K20260508_19 respectively) with no separate action required.

What KernelCare customers need to do

In most cases, nothing. If kcarectl auto-update is enabled (the default), the patch is fetched and applied on the next scheduled poll. To apply it immediately:

kcarectl --update

How to verify you are patched

Check the build time of the loaded patch:

kcarectl --info | grep kpatch-build-time

Any patch dated May 8, 2026 or later contains the fix. To confirm by CVE reference instead:

kcarectl --patch-info | grep -i 'CVE-2026-43284\|CVE-2026-43500\|dirty.frag\|xfrm'

The kernel version string returned by uname -r does not change with KernelCare, since the running kernel is patched in memory rather than replaced on disk.

Temporary mitigation (if you cannot update immediately)

If applying the KernelCare live patch is not possible right now, blacklist the esp4, esp6, and rxrpc modules so they cannot be loaded, and unload them if already present:

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

To revert after the live patch is applied:

sudo rm /etc/modprobe.d/dirtyfrag.conf

Compatibility: esp4 and esp6 are the kernel-side ESP transforms used by IPsec. Disabling them breaks IPsec tunnels that rely on the kernel data path on the affected machine. Do not apply this mitigation on hosts that terminate or transit IPsec, strongSwan, or Libreswan tunnels. rxrpc is the AF_RXRPC transport used almost exclusively by AFS clients and is not present on typical web-hosting servers.

Restore page-cache binaries after mitigation

The exploit can modify legitimate system binaries in the page cache as part of gaining root, so the mitigation alone is not enough on systems that may have been targeted before it was in place. After mitigating, drop the page cache:

echo 3 | sudo tee /proc/sys/vm/drop_caches

Not using KernelCare yet?

KernelCare delivers live patches for kernel CVEs to running systems with no reboot and no maintenance window. The same delivery model that closed Dirty Frag within 24 hours of public disclosure applies to every high-severity kernel CVE going forward.

Start a free trial