{"id":"linux-qnap-dirty-frag-may-2026","category":"patch","status":"live","title":"Dirty Frag flaws let local users take over Linux computers and QNAP storage devices","tldr":"Dirty Frag lets someone already running code on affected Linux computers or QNAP storage gain full administrator access. Install your Linux distributor's kernel updates and restart; update QNAP firmware. Some specialised Ubuntu kernels still await fixes.","summary":"Dirty Frag comprises two Linux kernel flaws disclosed on 7 May: CVE-2026-43284 in IPsec ESP networking and CVE-2026-43500 in RxRPC networking. They let a local user gain root, the account with full control, and may also allow escape from a container. QNAP confirmed the first flaw affected all its x86 and ARM64 NAS models, QuTS hero models and QuTScloud instances; its products were unaffected by the second. QNAP marked its issue resolved on 25 May but gives no minimum fixed firmware versions. Standard Ubuntu kernel updates are available, although Canonical's trackers still mark the specialised Ubuntu 24.04 linux-azure-nvidia package vulnerable to both flaws. Overall patch coverage therefore remains partial. Public demonstrations exist, but the reviewed sources do not establish real-world attacks using either CVE. Canonical's blog quotes an 8.8 score for CVE-2026-43284, while its current Ubuntu tracker gives 7.8.","action":"Install your Linux distributor's latest security kernel update and restart the computer; ask your IT provider to check any specialised kernel against both CVEs. For QNAP storage, install the latest firmware offered for your model, or ask whoever manages it to confirm the Dirty Frag fix is included.","product":"Linux computers and servers; QNAP NAS storage devices and QuTScloud","audience":"both","severity":"high","patch":"partial","exploited":false,"cves":["CVE-2026-43284","CVE-2026-43500"],"tags":["linux","ubuntu","qnap","nas","dirty-frag","privilege-escalation"],"affected":["Linux kernels containing the vulnerable IPsec ESP or RxRPC networking code; exposure depends on the distributor and kernel package","Ubuntu linux packages before the listed fixed versions; Ubuntu 18.04's standard 4.15 kernel is affected by CVE-2026-43284 but not CVE-2026-43500","Ubuntu 24.04 LTS linux-azure-nvidia: both CVEs remain marked vulnerable, with work in progress","All QNAP x86-based NAS models: CVE-2026-43284","All QNAP ARM64-based NAS models: CVE-2026-43284","All QuTS hero NAS models: CVE-2026-43284","All QuTScloud NAS instances: CVE-2026-43284"],"fixed":["Ubuntu 18.04 LTS linux 4.15.0-251.263: CVE-2026-43284","Ubuntu 18.04 LTS HWE linux 5.4.0-231.251~18.04.1","Ubuntu 20.04 LTS linux 5.4.0-231.251","Ubuntu 20.04 LTS HWE linux 5.15.0-181.191~20.04.1","Ubuntu 22.04 LTS linux 5.15.0-181.191","Ubuntu 22.04 LTS HWE linux 6.8.0-124.124~22.04.1","Ubuntu 24.04 LTS linux 6.8.0-124.124","Ubuntu 24.04 LTS HWE linux 6.17.0-35.35~24.04.1","Ubuntu 25.10 linux 6.17.0-35.35","Ubuntu 26.04 LTS linux 7.0.0-22.22"],"matches":[{"platform":"linux","app":"Ubuntu 18.04 LTS (4.15 kernel)","bundle":"","fixed":"4.15.0-251.263"},{"platform":"linux","app":"Ubuntu 18.04 LTS (5.4 HWE kernel)","bundle":"","fixed":"5.4.0-231.251~18.04.1"},{"platform":"linux","app":"Ubuntu 20.04 LTS (5.4 kernel)","bundle":"","fixed":"5.4.0-231.251"},{"platform":"linux","app":"Ubuntu 20.04 LTS (5.15 HWE kernel)","bundle":"","fixed":"5.15.0-181.191~20.04.1"},{"platform":"linux","app":"Ubuntu 22.04 LTS (5.15 kernel)","bundle":"","fixed":"5.15.0-181.191"},{"platform":"linux","app":"Ubuntu 22.04 LTS (6.8 HWE kernel)","bundle":"","fixed":"6.8.0-124.124~22.04.1"},{"platform":"linux","app":"Ubuntu 24.04 LTS (6.8 kernel)","bundle":"","fixed":"6.8.0-124.124"},{"platform":"linux","app":"Ubuntu 24.04 LTS (6.17 HWE kernel)","bundle":"","fixed":"6.17.0-35.35~24.04.1"},{"platform":"linux","app":"Ubuntu 25.10","bundle":"","fixed":"6.17.0-35.35"},{"platform":"linux","app":"Ubuntu 26.04 LTS","bundle":"","fixed":"7.0.0-22.22"},{"platform":"nas","app":"QNAP QTS","bundle":"","fixed":""},{"platform":"nas","app":"QNAP QuTS hero","bundle":"","fixed":""}],"sources":[{"kind":"advisory","title":"Local Privilege Escalation Vulnerability in Linux Kernel (Dirty Frag) — QSA-26-17","url":"https://www.qnap.com/en-us/security-advisory/qsa-26-17","by":"QNAP","date":"2026-05-25"},{"kind":"advisory","title":"CVE-2026-43284","url":"https://ubuntu.com/security/CVE-2026-43284","by":"Canonical","date":"2026-10-12"},{"kind":"advisory","title":"CVE-2026-43500","url":"https://ubuntu.com/security/CVE-2026-43500","by":"Canonical","date":"2026-10-12"},{"kind":"post","title":"Dirty Frag Linux kernel local privilege escalation vulnerability mitigations","url":"https://canonical.com/blog/dirty-frag-linux-vulnerability-fixes-available","by":"Canonical","date":"2026-05-08"},{"kind":"advisory","title":"Dirty Frag — Universal Local Privilege Escalation in Linux","url":"https://security.berkeley.edu/news/dirty-frag-universal-local-privilege-escalation-linux","by":"UC Berkeley Information Security Office","date":"2026-05-08"},{"kind":"advisory","title":"AL26-011 — Vulnerabilities affecting Linux — CVE-2026-43284 and CVE-2026-43500","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-011-vulnerabilities-affecting-linux-cve-2026-43284-cve-2026-43500","by":"Canadian Centre for Cyber Security","date":"2026-05-08"},{"kind":"advisory","title":"Proof-of-Concept Exploit Released for Three Vulnerabilities in the Linux Kernel","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4779","by":"NHS England","date":"2026-10-29"}],"started":"2026-05-07","closed":null,"created":"2026-11-03T21:14:56.350Z","updated":"2026-11-03T21:14:56.350Z","cve_notes":[{"cve":"CVE-2026-43284","name":"Dirty Frag privilege escalation in Linux IPsec ESP","what":"Incorrect handling of shared memory pages in Linux's IPsec ESP networking code lets a local attacker alter protected data and gain full administrator access.","severity":"high","cvss":7.8},{"cve":"CVE-2026-43500","name":"Dirty Frag privilege escalation in Linux RxRPC","what":"Linux's RxRPC networking code can decrypt data into shared memory pages without first making a private copy, allowing a local attacker to alter protected data and gain full administrator access.","severity":"high","cvss":7.8}],"timeline":[{"at":"2026-10-12","added":"2026-11-03T21:11:13.172Z","kind":"vendor-revised","text":"Canonical's updated tracker listed fixes for standard Ubuntu kernels, including 6.8.0-124.124 on Ubuntu 24.04. Its specialised Ubuntu 24.04 linux-azure-nvidia package remained marked vulnerable, with work in progress.","url":"https://ubuntu.com/security/CVE-2026-43284","by":"Canonical","patch":"partial"},{"at":"2026-05-25","added":"2026-11-03T21:11:13.172Z","kind":"new-fix","text":"QNAP marked its issue resolved and instructed owners to install the latest firmware. Its advisory does not identify minimum fixed firmware versions.","url":"https://www.qnap.com/en-us/security-advisory/qsa-26-17","by":"QNAP","patch":null},{"at":"2026-05-11","added":"2026-11-03T21:11:13.172Z","kind":"vendor-revised","text":"QNAP published its advisory confirming CVE-2026-43284 affected its x86 and ARM64 NAS models, QuTS hero models and QuTScloud instances. QNAP products were unaffected by CVE-2026-43500.","url":"https://www.qnap.com/en-us/security-advisory/qsa-26-17","by":"QNAP","patch":null},{"at":"2026-05-11","added":"2026-11-03T21:11:13.172Z","kind":"new-fix","text":"NHS England recorded publication of security patches for CVE-2026-43500. Users still needed kernel packages containing the fixes from their own Linux distributor.","url":"https://digital.nhs.uk/cyber-alerts/2026/cc-4779","by":"NHS England","patch":"partial"},{"at":"2026-05-08","added":"2026-11-03T21:11:13.172Z","kind":"other","text":"Canada's Cyber Centre warned that no fix covered all stable kernels and recommended temporary mitigations while distribution updates were prepared.","url":"https://www.cyber.gc.ca/en/alerts-advisories/al26-011-vulnerabilities-affecting-linux-cve-2026-43284-cve-2026-43500","by":"Canadian Centre for Cyber Security","patch":null},{"at":"2026-05-07","added":"2026-11-03T21:11:13.172Z","kind":"disclosed","text":"Dirty Frag became public, with working demonstrations showing how a local user could gain full administrator access on Linux.","url":"https://security.berkeley.edu/news/dirty-frag-universal-local-privilege-escalation-linux","by":"UC Berkeley Information Security Office","patch":"none"}],"url":"https://hard.fyi/live/linux-qnap-dirty-frag-may-2026/","json":"https://hard.fyi/api/live?id=linux-qnap-dirty-frag-may-2026"}