NewsCompaniesFlawsGuides
Get the app
HighPartly fixedUpdated

Dirty Frag flaws let local users take over Linux computers and QNAP storage devices

Dirty Frag lets someone already running code on affected Linux computers or QNAP storage gain full administrator access. Install your Linux distributor's kernel updates and restart; update QNAP firmware. Some specialised Ubuntu kernels still await fixes.

What to do

Install your Linux distributor's latest security kernel update and restart the computer; ask your IT provider to check any specialised kernel against both CVEs. For QNAP storage, install the latest firmware offered for your model, or ask whoever manages it to confirm the Dirty Frag fix is included.

Check your devices
  • Ubuntu 18.04 LTS (4.15 kernel)fixed in 4.15.0-251.263 and later
  • Ubuntu 18.04 LTS (5.4 HWE kernel)fixed in 5.4.0-231.251~18.04.1 and later
  • Ubuntu 20.04 LTS (5.4 kernel)fixed in 5.4.0-231.251 and later
  • Ubuntu 20.04 LTS (5.15 HWE kernel)fixed in 5.15.0-181.191~20.04.1 and later
  • Ubuntu 22.04 LTS (5.15 kernel)fixed in 5.15.0-181.191 and later
  • Ubuntu 22.04 LTS (6.8 HWE kernel)fixed in 6.8.0-124.124~22.04.1 and later
  • Ubuntu 24.04 LTS (6.8 kernel)fixed in 6.8.0-124.124 and later
  • Ubuntu 24.04 LTS (6.17 HWE kernel)fixed in 6.17.0-35.35~24.04.1 and later
  • Ubuntu 25.10fixed in 6.17.0-35.35 and later
  • Ubuntu 26.04 LTSfixed in 7.0.0-22.22 and later
  • QNAP QTSno fixed version yet
  • QNAP QuTS herono fixed version yet

What’s happening

Dirty Frag comprises two Linux kernel flaws disclosed on 7 May: CVE-2026-43284 in IPsec ESP networking and CVE-2026-43500 in RxRPC networking. They let a local user gain root, the account with full control, and may also allow escape from a container. QNAP confirmed the first flaw affected all its x86 and ARM64 NAS models, QuTS hero models and QuTScloud instances; its products were unaffected by the second. QNAP marked its issue resolved on 25 May but gives no minimum fixed firmware versions. Standard Ubuntu kernel updates are available, although Canonical's trackers still mark the specialised Ubuntu 24.04 linux-azure-nvidia package vulnerable to both flaws. Overall patch coverage therefore remains partial. Public demonstrations exist, but the reviewed sources do not establish real-world attacks using either CVE. Canonical's blog quotes an 8.8 score for CVE-2026-43284, while its current Ubuntu tracker gives 7.8.

What
Flaw
Affects
Linux computers and servers; QNAP NAS storage devices and QuTScloud
Affected
Linux kernels containing the vulnerable IPsec ESP or RxRPC networking code; exposure depends on the distributor and kernel package
Ubuntu linux packages before the listed fixed versions; Ubuntu 18.04's standard 4.15 kernel is affected by CVE-2026-43284 but not CVE-2026-43500
Ubuntu 24.04 LTS linux-azure-nvidia: both CVEs remain marked vulnerable, with work in progress
All QNAP x86-based NAS models: CVE-2026-43284
All QNAP ARM64-based NAS models: CVE-2026-43284
All QuTS hero NAS models: CVE-2026-43284
All QuTScloud NAS instances: CVE-2026-43284
Fixed in
Ubuntu 18.04 LTS linux 4.15.0-251.263: CVE-2026-43284
Ubuntu 18.04 LTS HWE linux 5.4.0-231.251~18.04.1
Ubuntu 20.04 LTS linux 5.4.0-231.251
Ubuntu 20.04 LTS HWE linux 5.15.0-181.191~20.04.1
Ubuntu 22.04 LTS linux 5.15.0-181.191
Ubuntu 22.04 LTS HWE linux 6.8.0-124.124~22.04.1
Ubuntu 24.04 LTS linux 6.8.0-124.124
Ubuntu 24.04 LTS HWE linux 6.17.0-35.35~24.04.1
Ubuntu 25.10 linux 6.17.0-35.35
Ubuntu 26.04 LTS linux 7.0.0-22.22
CVE
CVE-2026-43284, CVE-2026-43500
Since
7 May 2026

Timeline

  1. Vendor revisedPartly fixed

    Canonical's updated tracker listed fixes for standard Ubuntu kernels, including 6.8.0-124.124 on Ubuntu 24.04. Its specialised Ubuntu 24.04 linux-azure-nvidia package remained marked vulnerable, with work in progress.

  2. New fix

    QNAP marked its issue resolved and instructed owners to install the latest firmware. Its advisory does not identify minimum fixed firmware versions.

  3. Vendor revised

    QNAP published its advisory confirming CVE-2026-43284 affected its x86 and ARM64 NAS models, QuTS hero models and QuTScloud instances. QNAP products were unaffected by CVE-2026-43500.

  4. New fixPartly fixed

    NHS England recorded publication of security patches for CVE-2026-43500. Users still needed kernel packages containing the fixes from their own Linux distributor.

  5. Update

    Canada's Cyber Centre warned that no fix covered all stable kernels and recommended temporary mitigations while distribution updates were prepared.

  6. Made publicNo fix yet

    Dirty Frag became public, with working demonstrations showing how a local user could gain full administrator access on Linux.

Sources

  1. Local Privilege Escalation Vulnerability in Linux Kernel (Dirty Frag) — QSA-26-17QNAP · 25 May 2026
  2. CVE-2026-43284Canonical · 12 Oct 2026
  3. CVE-2026-43500Canonical · 12 Oct 2026
  4. Dirty Frag Linux kernel local privilege escalation vulnerability mitigationsCanonical · 8 May 2026
  5. Dirty Frag — Universal Local Privilege Escalation in LinuxUC Berkeley Information Security Office · 8 May 2026
  6. AL26-011 — Vulnerabilities affecting Linux — CVE-2026-43284 and CVE-2026-43500Canadian Centre for Cyber Security · 8 May 2026
  7. Proof-of-Concept Exploit Released for Three Vulnerabilities in the Linux KernelNHS England · 29 Oct 2026
HARD Live follows this until it’s over: each change is added to the timeline with its source. Everything live · Everything from May 2026 · JSON · RSS