Vulnerability overview
The Alibaba Cloud Linux security team is aware of a set of recently disclosed local privilege escalation vulnerabilities in the Linux kernel, collectively known as Dirty Frag. These vulnerabilities exploit a flaw in the shared ownership of page fragments within a socket buffer (skb) in the kernel's networking subsystem. This allows an in-place decrypt path to modify page data not privately owned by the kernel, which can lead to local privilege escalation to root.
Dirty Frag consists of two related CVEs, affecting the IPsec ESP and RxRPC modules respectively:
|
CVE ID |
Affected module |
Severity |
|
CVE-2026-43284 |
|
High |
|
CVE-2026-43500 |
|
High |
Publicly available proof-of-concept (PoC) exploit code has demonstrated reliable local root privilege escalation on major Linux distributions. If an attacker gains low-privilege execution on a target system (for example, a standard user shell, a compromised web process, or as a prerequisite for container escape), they can exploit this vulnerability to fully compromise the affected node.
Vulnerability details
CVE-2026-43284 (ESP in-place decrypt vulnerability)
Vulnerability Mechanism:
In the Linux kernel's IPsec ESP input path, when processing ESP-in-UDP packets, if page fragments are appended directly to a socket buffer (skb) from a pipe using methods like MSG_SPLICE_PAGES, splice(2), or sendfile(2), the kernel should mark the skb with the SKBFL_SHARED_FRAG flag. This flag ensures that any code path that might modify the packet data first performs a copy-on-write (COW).
However, the IPv4/IPv6 packet append path fails to correctly set the SKBFL_SHARED_FRAG flag when splicing page fragments for a UDP skb. This causes the ESP input handler to misinterpret an skb that contains external pipe pages as a normal, non-cloned, linear skb. As a result, it performs an in-place decrypt operation directly on the external page, which is not privately owned by the kernel.
A malicious actor can craft a specific pipe page layout to corrupt or expose sensitive page cache data, such as the contents of critical system files like /etc/passwd, during the ESP decryption phase. This can lead to local privilege escalation to root.
Affected kernel versions: This vulnerability was introduced in Linux 4.11 and affects all subsequent unpatched versions.
CVE-2026-43500 (RxRPC page cache write vulnerability)
Vulnerability Mechanism:
CVE-2026-43500, the other component of the Dirty Frag vulnerability family, resides in the kernel's rxrpc (Remote Procedure Call over RX) module. It shares the same root cause as CVE-2026-43284: the RxRPC receive path also performs in-place decryption or write operations on shared skb fragments. When these fragments are from an external reference, such as a pipe page, the kernel incorrectly modifies non-private data, leading to page cache corruption and privilege escalation.
Unlike CVE-2026-43284, CVE-2026-43500 primarily affects systems where the rxrpc kernel module is enabled. This module is typically provided in packages like kernel-modules-extra or kernel-modules-partner in some distributions.
Affected products and versions
The following Alibaba Cloud Linux products and versions are affected by the Dirty Frag vulnerability:
|
Product |
Kernel version |
Affected CVE |
Status |
|
Alibaba Cloud Linux 2 |
4.19.91-28.5.al7 and earlier |
CVE-2026-43284 |
Affected |
|
Alibaba Cloud Linux 3 |
5.10.134-19.3.1.al8 and earlier |
CVE-2026-43284 |
Affected |
|
Alibaba Cloud Linux 4 |
6.6.102-5.3.1.alnx4 and earlier |
CVE-2026-43284 |
Affected |
Alibaba Cloud Linux kernels do not include the rxrpc module by default. Therefore, they are affected only by CVE-2026-43284, not CVE-2026-43500.
Mitigation
This vulnerability exploits the xfrm-ESP module. Disabling this module as a mitigation may disrupt IPsec (VPN) services. If your services depend on this module, evaluate the impact before disabling it.
Disable the xfrm-ESP module:
sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf"
sudo rmmod esp4 esp6 2> /dev/null || trueRemediation
Alibaba Cloud Linux has released official patches to address the CVE-2026-43284 vulnerability.
Operating system | Remediation details |
Alibaba Cloud Linux 4 | |
Alibaba Cloud Linux 4 (hot patch) | |
Alibaba Cloud Linux 3 | |
Alibaba Cloud Linux 3 (hot patch) |
Apply the fix using one of the following methods:
System upgrade
Upgrade your system packages by running the yum update command as soon as possible. After the upgrade, you must restart the instance for the patch to take effect.
Hot patch
For systems that cannot be restarted immediately, Alibaba Cloud Linux provides a hot patch. For detailed instructions on how to install and verify the hot patch, see Hot patch instructions for CVE-2026-43284.