VulnHub

Real-time Cybersecurity News

Dirty Frag: Unpatched Linux vulnerability delivers root access

Help Net Security
LinuxCVEExploitVulnerabilityPrivilege Escalation

Overview

A new vulnerability in Linux, named 'Dirty Frag', has emerged, specifically affecting the xfrm-ESP and RxRPC modules. One of the flaws, identified as CVE-2026-43284, has already been patched in the Linux kernel, but the second flaw, CVE-2026-43500, remains unpatched. This situation poses a significant risk as attackers can exploit the unpatched vulnerability to gain root access to affected systems. The implications are serious, particularly for organizations using Linux systems that rely on these modules for secure networking. Users and system administrators are urged to apply the latest patches for the patched vulnerability and remain vigilant for updates regarding the unpatched issue.

Key Takeaways

  • Affected Systems: Linux systems utilizing xfrm-ESP and RxRPC modules for IPsec protocols.
  • Action Required: Apply the latest Linux kernel updates to patch CVE-2026-43284.
  • Timeline: Newly disclosed

Original Article Summary

A week after Copy Fail, another Linux local privilege escalation vulnerability dubbed “Dirty Frag” has been revealed, along with a PoC exploit. What is Dirty Frag In effect, Dirty Frag refers to two flaws: A xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284, aka Copy Fail 2.0), now patched in the Linux kernel, affects the modules supporting one of the protocols used for IPsec A RxRPC Page-Cache Write vulnerability (CVE number reserved: CVE-2026-43500), currently unpatched, affects the modules … More → The post Dirty Frag: Unpatched Linux vulnerability delivers root access appeared first on Help Net Security.

Impact

Linux systems utilizing xfrm-ESP and RxRPC modules for IPsec protocols.

Exploitation Status

The exploitation status is currently unknown. Monitor vendor advisories and security bulletins for updates.

Timeline

Newly disclosed

Remediation

Apply the latest Linux kernel updates to patch CVE-2026-43284. Monitor for updates regarding CVE-2026-43500 and implement security best practices to limit exposure until a patch is available.

Additional Information

This threat intelligence is aggregated from trusted cybersecurity sources. For the most up-to-date information, technical details, and official vendor guidance, please refer to the original article linked below.

Related Topics: This incident relates to Linux, CVE, Exploit, and 2 more.

Read Original Article

Related Coverage

Canvas, Shai-Hulud, QuasarRat, 0Days, Anthropic, Aaran Leyland, and EU Compliance! - SWN #579

SCM feed for Latest

The article discusses several cybersecurity topics, including new vulnerabilities and incidents. Notably, it mentions a zero-day exploit affecting Canvas, a learning management system used by educational institutions. This vulnerability could allow attackers to execute unauthorized code, putting sensitive student data at risk. Additionally, it highlights the QuasarRat malware, which has been observed in the wild, targeting various systems. The article also touches on compliance issues faced by companies like Anthropic regarding EU regulations, which can impact their operations. Overall, these developments serve as a reminder for organizations to stay vigilant and update their security measures regularly to protect against evolving threats.

May 8, 2026

Fake macOS Troubleshooting Sites Used to Steal iCloud Data in ClickFix Scam

Hackread – Cybersecurity News, Data Breaches, AI and More

Microsoft researchers have identified a new scam called ClickFix that targets macOS users. Attackers are creating fake troubleshooting guides on platforms like Medium and Craft, tricking users into executing Terminal commands that deploy malicious software known as AMOS and SHub Stealer. This malware is designed to steal iCloud data, which can lead to significant personal and financial loss for affected users. The campaign highlights the need for vigilance among macOS users, as these deceptive tactics can easily lure unsuspecting individuals into compromising their personal information. Awareness and skepticism towards unsolicited troubleshooting advice are crucial in protecting one's digital assets.

May 8, 2026

ShinyHunters Claims Second Attack Against Instructure

darkreading

Instructure, the edtech company known for its learning management systems, is facing a serious cybersecurity incident as the hacker group ShinyHunters claims responsibility for a second attack. This breach reportedly puts personal identifiable information (PII) of hundreds of millions of users at risk. The company is currently struggling to regain control and secure its systems from these hackers. The implications of this breach are significant, as it could lead to identity theft and other forms of exploitation for affected individuals. As the situation unfolds, users and institutions relying on Instructure's services need to stay vigilant about their data security.

May 8, 2026

'Dirty Frag' Linux zero-day exposes most distributions to LPE

SCM feed for Latest

A newly discovered zero-day vulnerability, dubbed 'Dirty Frag', affects most Linux distributions and allows attackers to escalate their privileges to root level. This means that a malicious actor could gain full control over a compromised system, putting sensitive data and operations at risk. The vulnerability is particularly concerning because it impacts a wide range of systems, making it a significant threat for both individual users and organizations that rely on Linux. Researchers are urging users and system administrators to take immediate action to secure their systems. The exact details of how this vulnerability can be exploited are still being analyzed, but the potential for active exploitation is high, prompting a call for swift remediation efforts.

May 8, 2026

Australian organizations warned of Vidar Stealer malware campaign using ClickFix technique

SCM feed for Latest

The Australian Cyber Security Center (ACSC) has alerted organizations about a new campaign distributing the Vidar Stealer malware through a method known as ClickFix. This technique employs social engineering tactics to trick users into downloading the malware, which is designed to steal sensitive information. The warning comes amidst growing concerns over the effectiveness of such tactics in infiltrating networks. Organizations in Australia need to be particularly vigilant as this campaign targets them directly, emphasizing the importance of user education and robust security practices. Failure to address these threats could lead to significant data breaches and financial losses.

May 8, 2026

California man sentenced to over 6 years for role in $250 million cryptocurrency heist

SCM feed for Latest

A California man has been sentenced to over six years in prison for his involvement in a massive cryptocurrency heist that netted around $250 million. The criminal group he was part of targeted individuals believed to hold significant amounts of cryptocurrency from late 2023 to early 2025. They employed social engineering tactics to gain unauthorized access to victims' digital wallets, effectively stealing their assets. This incident illustrates the growing risk of cryptocurrency theft, particularly as more people invest in digital currencies. It serves as a stark reminder for cryptocurrency holders to enhance their security measures and remain vigilant against social engineering scams.

May 8, 2026