CVE detail
CVE-2026-43500
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 30.0 · diversity 20.0 · KEV 0.0 · OTX 0.0 · PoC 10.8
Why it matters now
Mention timeline
- Total mentions
- 2
- within the 30d window
- Peak daily
- 1
- highest bucket
Evidence
Source links by recency
22 source links · newest first
M hypervisor that allows code running inside a guest virtual machine to corrupt host kernel memory. The bug, tracked as CVE-2026-53359 and named Januscape, has been sitting in the kernel since August 2010. It affects both Intel and AMD processors, which makes it the first publicly documented guest-to-host KVM exploit that works across both architecture
newssecurityaffairs.comJul 7, 2026, 7:07 AMA variant of DirtyFrag, the flaw allows unprivileged local users to manipulate the Linux page cache and gain root privileges.
newswww.securityweek.comJun 29, 2026, 11:20 AMDirtyClone: a Linux kernel privilege escalation that silently rewrites executables in memory, leaving no disk trace. Patch now. JFrog Security Research published a working exploit walkthrough on June 25 for CVE-2026-43503 (CVSS score of 8.8), a Linux kernel privilege escalation they call DirtyClone. It’s the fourth vulnerability in the DirtyFrag family, all sharing the same […]
newssecurityaffairs.comJun 27, 2026, 9:12 AM- DirtyDecrypt: PoC Released for yet another Linux flawSecurity Affairs
DirtyDecrypt (CVE-2026-31635): working PoC out for a Linux kernel LPE flaw. Missing COW guard in rxgk_decrypt_skb lets local attackers reach root. After Copy Fail, Dirty Frag, and Fragnesia, here comes DirtyDecrypt, another local privilege escalation vulnerability in the kernel, this time with a working proof-of-concept already out in the open. The flaw was discovered and […]
newssecurityaffairs.comMay 20, 2026, 7:36 AM Information published.
vendormsrc.microsoft.comMay 12, 2026, 8:07 AMLinux server admins may get the ability to turn off a vulnerable function in the OS kernel until a patch for a zero-day vulnerability is ready, if a proposal from a kernel developer and maintainer is accepted by the open source community. The idea of a kill switch for privileged operators has been suggested by […]
newswww.csoonline.comMay 12, 2026, 12:47 AMLinked URL: https://github.com/liamromanis101/DirtyFrag-Detector | Posted by lromanis | 2 points | 0 comments
communitynews.ycombinator.comMay 11, 2026, 8:21 PMLinux kernel developers are reviewing a proposal for an emergency risk mitigation mechanism (“Killswitch”) that would allow administrators to disable vulnerable kernel functions at runtime. The proposal, submitted by Linux kernel developer/maintainer Sasha Levin, arrives in the wake of the public disclosure of two privilege escalation vulnerabilities affecting the Linux kernel. What prompted the proposal The impetus for the proposal is explicit: the patch’s selftest references Copy Fail (CVE-2026-31431), a nine-year-old local privilege escalation flaw … More →
newswww.helpnetsecurity.comMay 11, 2026, 12:55 PMA newly disclosed Linux privilege escalation issue dubbed “Dirty Frag” is giving attackers a cleaner path to post-compromise escalation to root privileges. According to Microsoft, a couple of vulnerabilities constituting the issue, affecting Linux kernel networking and memory-fragment handling components, are already seeing active exploitation in the wild. The exploitation attempts look indistinguishable from the […]
newswww.csoonline.comMay 11, 2026, 12:01 PM- https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43500.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMay 11, 2026, 8:16 AM - https://github.com/V4bel/dirtyfraggithub.com
No excerpt available.
Exploitgithub.comMay 11, 2026, 8:16 AM - https://bugzilla.redhat.com/show_bug.cgi?id=2468273bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMay 11, 2026, 8:16 AM - https://access.redhat.com/security/cve/CVE-2026-43500access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 11, 2026, 8:16 AM No excerpt available.
Patchgit.kernel.orgMay 11, 2026, 8:16 AMNo excerpt available.
Patchgit.kernel.orgMay 11, 2026, 8:16 AMNo excerpt available.
Patchgit.kernel.orgMay 11, 2026, 8:16 AMNo excerpt available.
Patchgit.kernel.orgMay 11, 2026, 8:16 AMNo excerpt available.
Patchgit.kernel.orgMay 11, 2026, 8:16 AMAlso called Copy Fail 2 and tracked as CVE-2026-43284 and CVE-2026-43500, the exploit was disclosed before a patch was released.
newswww.securityweek.comMay 11, 2026, 8:15 AMA new round of the weekly Security Affairs newsletter has arrived! Every week, the best security articles from Security Affairs are free in your email box. Enjoy a new round of the weekly SecurityAffairs newsletter, including the international press. Quasar Linux RAT (QLNX): A Fileless Linux Implant Built for Stealth and Persistence Braintrust security incident […]
newssecurityaffairs.comMay 10, 2026, 8:20 AMLinked URL: https://blog.cloudlinux.com/dirty-frag-mitigation-and-kernel-update | Posted by abdelhousni | 3 points | 0 comments
communitynews.ycombinator.comMay 8, 2026, 7:14 PM- Dirty Frag: Unpatched Linux vulnerability delivers root accessHelp Net Security
A week after Copy Fail, another Linux local privilege escalation vulnerability dubbed “Dirty Frag” has been revealed, along with a PoC exploit. What is Dirty Frag In effect, Dirty Frag refers to two flaws: A xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284, aka Copy Fail 2.0), now patched in the Linux kernel, affects the modules supporting one of the protocols used for IPsec A RxRPC Page-Cache Write vulnerability (CVE number reserved: CVE-2026-43500), currently unpatched, affects the modules … More →
newswww.helpnetsecurity.comMay 8, 2026, 2:13 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
2 repository references · best confidence 0.99 · max 2 stars
- krisiasty/vcheckMedium confidencegithubRepository topic discovery2 starsDiscovered Jul 13, 2026, 10:51 AM
- AK777177/Dirty-Frag-AnalysisHigh confidencegithubDiscovery source unavailable2 starsDiscovered Jul 9, 2026, 1:19 AM
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-46300CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach paged frags from @fr…
- CVE-2026-25634CVSS 7.8 · High
iccDEV provides a set of libraries and tools that allow for the interaction, manipulation, and application of ICC color management profiles. Prior to 2.3.1.4, SrcPixel and DestPix…
- CVE-2025-62164CVSS 8.8 · High
vLLM is an inference and serving engine for large language models (LLMs). From versions 0.10.2 to before 0.11.1, a memory corruption vulnerability could lead to a crash (denial-of…
- CVE-2025-22225CVSS 8.2 · High
VMware ESXi contains an arbitrary write vulnerability. A malicious actor with privileges within the VMX process may trigger an arbitrary kernel write leading to an escape of the s…
- CVE-2024-20141CVSS 6.6 · Medium
In V5 DA, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege, if an attacker has physical access to the device…
- CVE-2024-47438CVSS 5.5 · Medium
Substance3D - Painter versions 10.1.0 and earlier are affected by a Write-what-where Condition vulnerability that could lead to a memory leak. This vulnerability allows an attacke…