Dirty Frag (CVE-2026-43284) Linux Privilege Escalation | Wiz Blog

What it is

"Dirty Frag" (CVE-2026-43284 and CVE-2026-43500), a Linux kernel local privilege-escalation chain disclosed by Hyunwoo Kim (@v4bel). It is the successor to "Copy Fail" (CVE-2026-31431); the public PoC "CopyFail2" is the same bug, reversed from the fix commit. It was disclosed before embargo expiration because details leaked once the fix was reverse-engineered. No official patch exists yet.

How it works

The chain combines two page-cache write primitives — one in xfrm-ESP (IPsec), one in RxRPC. Both let an attacker modify page-cache-backed memory that the kernel does not exclusively own, corrupting sensitive files to escalate to root. Unlike race-based bugs, this class is deterministic and highly reliable, in the same family as Dirty Pipe and Copy Fail. Exploitation needs two things: reachability of the vulnerable kernel interfaces, and the ability to manipulate page-backed buffers (e.g., via splice()-related paths).

Preconditions / Affected

• Elevated privilege is typically required — specifically CAP_NET_ADMIN.
• The vulnerable ESP code dates to ~2017 and the RxRPC code to ~2023, so a wide range of kernel versions is likely affected. No complete version matrix is published yet; full scope is still under investigation.
• Exposure depends heavily on environment (see diagram).

flowchart TD
    A[Local access + CAP_NET_ADMIN] --> B{Environment}
    B -->|Hardened container<br/>K8s default seccomp| C[Exploitation less likely]
    B -->|VM / less-restricted host| D[Significant risk]
    D --> E[Reach ESP or RxRPC iface]
    E --> F[Manipulate page buffers via splice]
    F --> G[Corrupt page-cache file → root]

What to do

The page states no patches are available and lists a "mitigations recommended" heading but provides no concrete commands, configuration, or detection steps in the fetched text. The only stated actions:

• Assume the vulnerability is valid and exploitable under certain conditions.
• Wiz customers can use pre-built queries and the advisory in the Wiz Threat Intel Center; Wiz says it will update that advisory as the situation develops.

Caveats

• Default seccomp profiles (e.g., Kubernetes) make exploitation less likely by restricting the needed capabilities — this is a partial, environment-dependent barrier, not a fix.
• The affected-products list and version matrix were incomplete at publication; treat scope as provisional.
• No verbatim mitigation commands are given, so there is nothing yet to apply beyond capability/seccomp hardening implied by the preconditions.