NewsCompaniesFlawsGuides
Get the app
HighPartly fixedUpdated

CVE-2026-43284

Incorrect handling of shared memory pages in Linux's IPsec ESP networking code lets a local attacker alter protected data and gain full administrator access.

What to do

Install your Linux distributor's latest security kernel update and restart the computer; ask your IT provider to check any specialised kernel against both CVEs. For QNAP storage, install the latest firmware offered for your model, or ask whoever manages it to confirm the Dirty Frag fix is included.

Affects
Linux computers and servers; QNAP NAS storage devices and QuTScloud
Severity
High · CVSS 7.8
Fixed in
Ubuntu 18.04 LTS linux 4.15.0-251.263: CVE-2026-43284
Ubuntu 18.04 LTS HWE linux 5.4.0-231.251~18.04.1
Ubuntu 20.04 LTS linux 5.4.0-231.251
Ubuntu 20.04 LTS HWE linux 5.15.0-181.191~20.04.1
Ubuntu 22.04 LTS linux 5.15.0-181.191
Ubuntu 22.04 LTS HWE linux 6.8.0-124.124~22.04.1
Ubuntu 24.04 LTS linux 6.8.0-124.124
Ubuntu 24.04 LTS HWE linux 6.17.0-35.35~24.04.1
Ubuntu 25.10 linux 6.17.0-35.35
Ubuntu 26.04 LTS linux 7.0.0-22.22
Being used in attacks
Not known to be
Made public
7 May 2026

Part of: Dirty Frag flaws let local users take over Linux computers and QNAP storage devices

Dirty Frag comprises two Linux kernel flaws disclosed on 7 May: CVE-2026-43284 in IPsec ESP networking and CVE-2026-43500 in RxRPC networking. They let a local user gain root, the account with full control, and may also allow escape from a container. QNAP confirmed the first flaw affected all its x86 and ARM64 NAS models, QuTS hero models and QuTScloud instances; its products were unaffected by the second. QNAP marked its issue resolved on 25 May but gives no minimum fixed firmware versions. Standard Ubuntu kernel updates are available, although Canonical's trackers still mark the specialised Ubuntu 24.04 linux-azure-nvidia package vulnerable to both flaws. Overall patch coverage therefore remains partial. Public demonstrations exist, but the reviewed sources do not establish real-world attacks using either CVE. Canonical's blog quotes an 8.8 score for CVE-2026-43284, while its current Ubuntu tracker gives 7.8.

The whole incident, its timeline and sources

Fixed in the same update

Sources

  1. Local Privilege Escalation Vulnerability in Linux Kernel (Dirty Frag) — QSA-26-17QNAP · 25 May 2026
  2. CVE-2026-43284Canonical · 12 Oct 2026
  3. CVE-2026-43500Canonical · 12 Oct 2026
  4. Dirty Frag Linux kernel local privilege escalation vulnerability mitigationsCanonical · 8 May 2026
  5. Dirty Frag — Universal Local Privilege Escalation in LinuxUC Berkeley Information Security Office · 8 May 2026
  6. AL26-011 — Vulnerabilities affecting Linux — CVE-2026-43284 and CVE-2026-43500Canadian Centre for Cyber Security · 8 May 2026
  7. Proof-of-Concept Exploit Released for Three Vulnerabilities in the Linux KernelNHS England · 29 Oct 2026
Also: CVE-2026-43284 at CVE.org · NVD · Every flaw being used in attacks · Everything live