CVERadar
HIGH · CVSS 3.1 8.8Metasploit moduleExploit-DBPublic PoCEPSS 94.19% (p100)Threat level 82

CVE-2026-43284: CVE-2026-43284: In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-p…

linux · linux kernel · NVD published 2026-05-08 · posted 2026-05-08 · last modified 2026-09-08

What it is

In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(), so later paths that may modify packet data can first make a private copy. The IPv4/IPv6 datagram append paths did not set this flag when splicing pages into UDP skbs. That leaves an ESP-in-UDP packet made from shared pipe pages looking like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW fast path for uncloned skbs without a frag_list and decrypts in place over data that is not owned privately by the skb. Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching TCP. Also make ESP input fall back to skb_cow_data() when the flag is present, so ESP does not decrypt externally backed frags in place. Private nonlinear skb frags still use the existing fast path. This intentionally does not change ESP output. In esp_output_head(), the path that appends the ESP trailer to existing skb tailroom without calling skb_cow_data() is not reachable for nonlinear skbs: skb_tailroom() returns zero when skb->data_len is nonzero, while ESP tailen is positive. Thus ESP output will either use the separate destination-frag path or fall back to skb_cow_data().

WeaknessCWE-123
CVSS vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67)
ATT&CK tacticsn/a

Exploitation evidence

First exploit evidence seen: 2026-05-08 (earliest date across the sources below).

Exploited in the wild

No source on this site lists in-the-wild exploitation yet (CISA KEV, VulnCheck KEV).

Public exploit code

Metasploit

Exploit-DB

  • EDB-52585: Linux Kernel - Local Privilege Escalation (2026-05-27)
  • EDB-52591: Linux Kernel - Local Privilege Escalation (2026-05-29)

GitHub proof-of-concept repositories

43 public repositories from 43 accounts, first seen 2026-05-08. Most starred: ankitrawatgit/DirtyFrag-Android-Root-Jailbreak (50 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: Rapid7 Metasploit Framework module metadata · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

No ATT&CK techniques could be mapped or inferred for this CVE yet.

How to fix it

Fixed versions

  • linux linux kernel: upgrade to 5.10.255 or later (affected from 4.11)
  • linux linux kernel: upgrade to 5.15.205 or later (affected from 5.12)
  • linux linux kernel: upgrade to 6.1.171 or later (affected from 5.16)
  • linux linux kernel: upgrade to 6.6.138 or later (affected from 6.2)
  • linux linux kernel: upgrade to 6.12.87 or later (affected from 6.7)
  • linux linux kernel: upgrade to 6.18.28 or later (affected from 6.13)
  • linux linux kernel: upgrade to 7.0.5 or later (affected from 7.0)

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

Detection Generic guidance

    Response checklist Generic guidance

    1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
    2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
    3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
    4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.

    Sources