Introduction to Malware Binary Triage (IMBT) Course
Looking to level up your skills? Get 10% off using coupon code: MWNEWS10 for any flavor.
Enroll Now and Save 10%: Coupon Code MWNEWS10
Note: Affiliate link – your enrollment helps support this platform at no extra cost to you.
<div>
<div>
<div><p><strong>Number:</strong> AL26-011<br /><strong>Date:</strong> May 8, 2026</p>
Audience
This Alert is intended for IT professionals and managers.
Purpose
An Alert is used to raise awareness of a recently identified cyber threat that may impact cyber information assets, and to provide additional detection and mitigation advice to recipients. The Canadian Centre for Cyber Security (Cyber Centre) is also available to provide additional assistance regarding the content of this Alert upon request.
Details
The Cyber Centre is aware of security vulnerabilities affecting Linux-based operating systems, identified as CVE-2026-43284Footnote 1 and CVE-2026-43500Footnote 2.
Tracked as CVE-2026-43284, this is a Linux kernel Write-what-where Condition vulnerability (CWE-123)Footnote 3 that may allow a local attacker to execute arbitrary code.
CVE-2026-43500 is a Linux kernel local privilege escalation (LPE) vulnerability in the RxRPC subsystem that may allow a local attacker to escalate privileges.
Public reporting and Linux kernel security advisoriesFootnote 4Footnote 5Footnote 6Footnote 7Footnote 8Footnote 9 indicate that these vulnerabilities originate in the Linux kernel and may, under certain conditions, allow privilege escalation to root or bypass of isolation mechanisms.
Publicly referred to as “Dirty Frag”, CVE-2026-43284 and CVE-2026-43500 can be chained to allow for a local unprivileged user to gain root accessFootnote 10. Chained with a remote code execution vulnerability, these vulnerabilities are even more significant and need to be prioritized for patching.
The Cyber Centre is aware of working publicly available Proof of Concepts (POC) exploiting these vulnerabilitiesFootnote 11.
Suggested actions
As of May 8, 2026, no universal fix has been released across all stable kernels for CVE-2026-43284 and CVE-2026-43500.
The Cyber Centre recommends that organizations identify and apply the recommended mitigations until patches become available.
Affected environments include, but are not limited to:
- Enterprise Linux distributions (Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, Oracle Linux, Fedora and CentOS Stream)
- Debian-based distributions (Debian, Ubuntu)
- SUSE-based distributions (SUSE Linux Enterprise, openSUSE)
- Other Linux systems running vulnerable kernel versions
Organizations should consult their respective distribution maintainers for version-specific impact and mitigation guidance. Organizations can determine whether systems may be affected by CVE-2026-43284 and CVE-2026-43500 in:
- Identifying the running Linux kernel version using the uname -r command that include:
<ul><li>ESP/XFRM IPsec support</li> <li>UDP ESP‑in‑UDP receive paths</li> <li>RXRPC enabled</li> </ul></li> <li>Checking whether the affected kernel modules are currently loaded by running <strong>lsmod | egrep '^(esp4|esp6|rxrpc)\b' or grep -qE '^(esp4|esp6|rxrpc) ' /proc/modules; </strong>no output indicates the modules are not currently loaded, but organizations should also confirm whether the modules are available to load and review vendor guidance, as module availability and default exposure vary by distribution.</li>
Until vendor patches are available, the Cyber Centre recommends that organizations:
- Disable vulnerable kernel modules (esp, esp6 and rxpc) if not required by running sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" or distro-specific guidance when availableFootnote 9Footnote 12. Note: Disabling esp4, esp6 may break IPsec. Disabling rxrpc may impact AFS-based systems. Regenerate the initramfs images to prevent the modules from being loaded during early boot by running sudo update-initramfs -u -k all or follow vendor-specific guidance when available
- Restrict local and remote access to affected systems, particularly in shared or multi-tenant environments
- Review and limit administrative privileges, including sudo and role-based access
- Monitor authentication, system, and kernel logs for signs of privilege escalation or abnormal activity
In addition, the Cyber Centre strongly recommends that organizations review and implement the Cyber Centre’s Top 10 IT Security Actions with an emphasis on the following topicsFootnote 13.
- Patch operating systems and applications
- Enforce the management of administrative privileges
- Harden operating systems and applications
- Segment and separate information
Should activity matching the content of this alert be discovered, recipients are encouraged to report via My Cyber Portal, or email [email protected].
References
- Footnote 1
-
<p><a rel="noreferrer" target="_blank">Return to footnote1 referrer</a></p> </dd> <dt>Footnote 2</dt> <dd> <p><a href="https://www.cve.org/CVERecord?id=CVE-2026-43500" rel="noreferrer" target="_blank">CVE-2026-43500</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote2 referrer</a></p> </dd> <dt>Footnote 3</dt> <dd> <p><a href="https://cwe.mitre.org/data/definitions/123.html" rel="noreferrer" target="_blank">CWE-123: Write-what-where Condition</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote3 referrer</a></p> </dd> <dt>Footnote 4</dt> <dd> <p><a href="https://aws.amazon.com/security/security-bulletins/rss/2026-027-aws/" rel="noreferrer" target="_blank">"Dirty Frag" and other issues in Amazon Linux kernels</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote4 referrer</a></p> </dd> <dt>Footnote 5</dt> <dd> <p><a href="https://security-tracker.debian.org/tracker/CVE-2026-43284" rel="noreferrer" target="_blank">Debian - CVE-2026-43284</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote5 referrer</a></p> </dd> <dt>Footnote 6</dt> <dd> <p><a href="https://bugzilla.redhat.com/show_bug.cgi?id=2467771" rel="noreferrer" target="_blank">Red Hat Bugzilla – Bug 2467771</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote6 referrer</a></p> </dd> <dt>Footnote 7</dt> <dd> <p><a href="https://www.suse.com/security/cve/CVE-2026-43284.html" rel="noreferrer" target="_blank">SUSE Common Vulnerabilities and Exposures - CVE-2026-43284</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote7 referrer</a></p> </dd> <dt>Footnote 8</dt> <dd> <p><a href="https://ubuntu.com/security/CVE-2026-43284" rel="noreferrer" target="_blank">Ubuntu - CVE-2026-43284</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote8 referrer</a></p> </dd> <dt>Footnote 9</dt> <dd> <p><a href="https://almalinux.org/blog/2026-05-07-dirty-frag/" rel="noreferrer" target="_blank">Dirty Frag (CVE-2026-43284, CVE-2026-43500) vulnerability fix is ready for testing</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote9 referrer</a></p> </dd> <dt>Footnote 10</dt> <dd> <p><a href="https://www.wiz.io/blog/dirty-frag-linux-kernel-local-privilege-escalation-via-esp-and-rxrpc" rel="noreferrer" target="_blank">Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote10 referrer</a></p> </dd> <dt>Footnote 11</dt> <dd> <p><a href="https://www.bleepingcomputer.com/news/security/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges/" rel="noreferrer" target="_blank">New Linux 'Dirty Frag' zero-day gives root on all major distros</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote11 referrer</a></p> </dd> <dt>Footnote 12</dt> <dd> <p><a href="https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available" rel="noreferrer" target="_blank">Dirty Frag Linux kernel local privilege escalation vulnerability mitigations</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote12 referrer</a></p> </dd> <dt>Footnote 13</dt> <dd> <p><a rel="noreferrer" target="_blank">Top 10 IT security actions to protect Internet connected networks and information (ITSM.10.089)</a></p> <p><a rel="noreferrer" target="_blank">Return to footnote13 referrer</a></p> </dd>
</div>
Article Link: AL26-011 - Vulnerabilities affecting Linux - CVE-2026-43284 and CVE-2026-43500 - Canadian Centre for Cyber Security