🛡️ CVE-2026-43500

The items that name it 6

• Dirty Frag (CVE-2026-43284): the Linux kernel bug that turns read access into root
  writeup2026-09-04

  Vulnerability in RxRPC (protocol used mainly by the AFS file system) handling in the Linux kernel; part of the Dirty Frag set; same page-cache write issue as CVE-2026-43284. Red Hat says this CVE does not affect its products.

• LSPosed/LSPromise
  repo2026-07-23

  DirtyFrag kernel vulnerability variant requiring RxRPC; disabled for Android Generic Kernels, so not exploitable on Android.

• Panic at the Distro
  writeup2026-05-14

  Second of the Dirty Frag vulnerabilities, introduced to the Linux kernel in 2023, affecting xfrm-ESP/RxRPC submodules; chained with CVE-2026-43284 for local privilege escalation. Announced by researcher Hyunwoo Kim on May 7, 2026.

• Vulnerability Garden
  tool2026-05-13
• Dirty Frag (CVE-2026-43284) Linux Privilege Escalation | Wiz Blog
  advisory2026-05-08

  Linux kernel local privilege escalation vulnerability, part of the 'Dirty Frag' chain, exploiting the RxRPC subsystem

• Three CVEs and the May 2026 Exploit Chain Nobody's Taking Seriously (nginx Rift)
  articleIt is written here as CVE-2026-43500 (Dirty Frag, two-bug chain with CVE-2026-43284): page-cache-to-root local privilege escalation, disclosed May 7 (2026) by Hyunwoo Kim.

  Dirty Frag, two-bug chain with CVE-2026-43284