Dirty Frag Linux kernel local privilege escalation vulnerability mitigations

Two local privilege escalation (LPE) vulnerabilities affecting the Linux kernel have been publicly disclosed on May 7, 2026. One of the vulnerabilities has been assigned the ID: CVE-2026-43284 . The other CVE ID is pending. Both are referred to as “Dirty Frag.” The affected components are Linux kernel modules. The first vulnerability impacts the modules that provide support for ESP (Encapsulating Security Protocol), one of the protocols used for IPsec (Internet Protocol Security). The second vulnerability impacts the modules that provide support for RxRPC, a protocol used for AFS (Andrew File System), a distributed file system. The vulnerabilities affect multiple Linux distributions, including all Ubuntu releases.

The vulnerabilities do not have CVSS scores assigned in the CVE List or NVD, but are assessed by Canonical to have a CVSS 3.1 score of 7.8, corresponding to a severity of HIGH.

This post describes mitigations that disable the affected modules and can be applied when Linux kernel packages which implement the proposed patch will be released.

On hosts that do not run container workloads, the vulnerability allows a local user to elevate privileges to the root user. The published exploit executes in this type of deployment.

In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host. A proof-of-concept exploit has not been published yet for container escape.

The mitigations disable the kernel modules that are used for IPsec ESP and RxRPC, respectively. The mitigations will affect functionality if these are in use by either:

As the vulnerabilities are independent, disabling only the esp4 / esp6 modules or only the rxrpc modules would leave the remaining ones exploitable.

The vulnerability fix will be distributed through the Linux kernel image packages. A mitigation which disables the affected modules can be applied according to the instructions below. The mitigation will not be necessary once the kernel is updated.

All of the releases from the table above are impacted.

The mitigations block the affected kernel modules from loading. This requires three steps:

Block the modules by creating a /etc/modprobe.d/dirty-frag.conf file:

Regenerate the initramfs images, to prevent the modules from being loaded during early boot:

Unload the modules, in case they are already loaded:

Check whether the modules are still loaded:

If the action indicates that the modules are not loaded, no further action is required. However, unloading the modules may not be possible if they are in use by applications. In these instances, a system reboot will enforce their blocking, but will affect applications:

Once kernel updates are available and installed, the mitigation can be removed:

Interested in running Ubuntu in your organisation?