Dirtyfrag: How the Universal Linux LPE Hits Your Homelab

What Dirty Frag is

Dirty Frag is a Linux local privilege escalation published on the oss-security list on 7 May 2026, with a full exploit, after the embargo broke. It chains two kernel bugs:

• CVE-2026-43284 in IPsec ESP (esp4, esp6)
• CVE-2026-43500 in RxRPC (rxrpc)

Both decrypt received network data in place, which can corrupt page-cache pages the attacker shouldn’t be able to write. The result is root for an unprivileged local user. At publication there were no patches or CVEs. Fixes followed in the days after.

Who should care: any host where something untrusted can run code. On a homelab that means LXC containers on a Proxmox host, shared shell accounts, and internet-facing services that could be compromised.

Fixed kernel versions (from the CVE records)

Kernel series	ESP fix (CVE-2026-43284)	RxRPC fix (CVE-2026-43500)
5.10	5.10.255	not listed in the CVE record
5.15	5.15.205	not listed in the CVE record
6.1	6.1.171	not listed in the CVE record
6.6	6.6.138	6.6.140
6.12	6.12.87	6.12.88
6.18	6.18.28	6.18.29
7.0	7.0.5	7.0.6
mainline	7.1	7.1

The ESP bug dates back to 4.11, the RxRPC one to 5.3. Distro kernels backport fixes under their own version numbers, so your distro’s advisory is what counts.

Patch

uname -r                       # what you're running now
# Debian / Ubuntu / Proxmox
sudo apt update && sudo apt full-upgrade
# Fedora / RHEL / Rocky / Alma
sudo dnf upgrade --refresh

Then reboot into the new kernel and check uname -r again.

Proxmox VE: apt update && apt dist-upgrade pulls the current proxmox-kernel. Migrate or shut down guests, reboot one node at a time, and check pvecm status before the next. LXC containers use the host’s kernel, so patching the host covers them. VMs need their own kernel updates.

If you can’t patch yet

Block the three modules, as given in the original disclosure. It’s covered in detail, including what it breaks, in Dirty Frag before the patch:

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

Sources: the oss-security disclosure, the CVE records for CVE-2026-43284 and CVE-2026-43500, and Sysdig’s analysis.

What’s Next

• Proxmox VE Homelab Setup: Complete Installation and Configuration Guide (2026): Lock down your Proxmox VE host before the next exploit drops
• Ansible for Homelabbers: Automate Everything from One Playbook: Build a full Ansible setup for managing your homelab fleet
• Debian 13.5 (Trixie) Released: What Homelab Admins Need to Know Before Updating: Automate security patching so you are never caught behind on a critical CVE
• Proxmox VE Homelab Setup: Complete Installation and Configuration Guide (2026): Migrate to unprivileged LXC containers and reduce kernel attack surface