This page may contain stale information. Last updated: 2026-06-28
Definition
DirtyFrag is a family of Linux kernel memory corruption vulnerabilities where socket buffers (skb) reference shared page-cache memory, weaponized through in-place cryptographic transforms (XFRM/IPsec ESP, RxRPC). Extends Dirty Pipe and Copy Fail bug classes.
Key Variants
| Variant | CVE | Subsystem | Disclosed |
|---|---|---|---|
| Copy Fail | CVE-2026-31431 | AF_ALG crypto | Apr 2026 |
| DirtyFrag | CVE-2026-43284 / CVE-2026-43500 | IPsec ESP + RxRPC | May 2026 |
| Fragnesia | CVE-2026-46300 | XFRM ESP-in-TCP | May 2026 |
| dirtyclone | CVE-2026-43503 | XFRM/IPsec via TEE | May 2026 |
Mechanism
SKBFL_SHARED_FRAG flag marks page-cache-backed skb data. When dropped during clone/coalesce/GRO paths, in-place decryption writes to file-backed pages → privilege escalation.