Dirty Frag (CVE-2026-43284 and CVE-2026-43500): Detecting unpatched local privilege escalation via Linux Kernel ESP and RxRPC

On May 8, 2026, CVE-2026-43284 and CVE-2026-43500, nicknamed Dirty Frag, were disclosed by independent researcher Hyunwoo Kim, who claims he was forced to publish ahead of schedule — and ahead of patches being released — after another party broke a coordinated embargo. The pair of vulnerabilities allows an unprivileged local user to corrupt arbitrary page caches and pivot to root on many Linux distributions. A working proof of concept (PoC) was published the same day, before any distribution shipped patched kernels. The ESP vulnerability (CVE-2026-43284) was introduced in January 2017 by commit cac2661c53f3, which moved IPsec ESP receive into an in-place decryption fast path. The RxRPC variant…