Dirty Frag is a Linux root exploit that capitalizes on a previously unknown vulnerability in the Linux kernel's networking stack, specifically in the handling of IPv6 fragmentation (CVE-2026-43284). This marks the second high-severity Linux exploit in just eight days, following Copy Fail.
Overview
Dirty Frag is a chained exploit that combines two Linux kernel vulnerabilities: CVE-2026-43284 and CVE-2026-43500. The root cause of CVE-2026-43284 lies in how the Linux kernel handles network packet memory in the IPsec/ESP path. An attacker who knows how to manipulate this behavior can achieve a controlled write into the kernel page cache and ultimately escalate to root.
What it does
Dirty Frag follows the same fundamental pattern as Copy Fail — a page cache write primitive turned into a root escalation — but through a completely different code path. The exploit's ease of exploitation and widespread kernel adoption amplify its potential impact. Every server running a mainstream Linux kernel built from roughly 2017 onwards is affected.
The fix
To fix the vulnerability, users should update their kernel to a patched version. Patched kernels are now available in production repositories as of May 8, 2026. For AlmaLinux, CloudLinux, Rocky Linux, CentOS Stream, RHEL, the command to update is:
sudo dnf clean metadata && sudo dnf upgrade
sudo reboot
For Debian / Ubuntu:
sudo apt update && sudo apt upgrade
sudo reboot
After rebooting, confirm the patched kernel is running with the command uname -r. If a reboot is not immediately possible, users can block the vulnerable modules from loading as an interim mitigation.
The disclosure of Dirty Frag highlights the importance of treating kernel updates with urgency, applying them as soon as they are available. For any server running web hosting workloads, it is crucial to patch today, reboot, verify, and set up alerting for future vulnerabilities.