Exploitation observed; activity peaked at 32 mentions and remains active
Recommended action window: Immediate (within 24h)
NVD description
In the Linux kernel, the following vulnerability has been resolved: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present The DATA-packet handler in rxrpc_input_call_event() and the RESPONSE handler in rxrpc_verify_response() copy the skb to a linear one before calling into the security ops only when skb_cloned() is true. An skb that is not cloned but still carries externally-owned paged fragments (e.g. SKBFL_SHARED_FRAG set by splice() into a UDP socket via __ip_append_data, or a chained skb_has_frag_list()) falls through to the in-place decryption path, which binds the frag pages directly into the AEAD/skcipher SGL via skb_to_sgvec(). Extend the gate to also unshare when skb_has_frag_list() or skb_has_shared_frag() is true. This catches the splice-loopback vector and other externally-shared frag sources while preserving the zero-copy fast path for skbs whose frags are kernel-private (e.g. NIC page_pool RX, GRO). The OOM/trace handling already in place is reused.
Priority
CRITICAL
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
DECLINING
If you run products in this scope, you should treat this CVE as relevant to your environment.
2 versions affected across 1 product
| Date | Total | Labels |
|---|
| 2026-05-08 | 32 | Active Exploitation2Disclosure14Disclousure1Exploit1General4Patch6PoC4 |
| 2026-05-09 | 30 | Active Exploitation2Disclosition1Disclosure6Exploit1False Positive1General6Patch9PoC4 |
| 2026-05-10 | 7 | Active Exploitation1Disclosure2General2PoC2 |
| 2026-05-11 | 28 | Active Exploitation3Disclosure4Exploit3General10Patch5PoC3 |
| 2026-05-12 | 19 | Active Exploitation7Disclosure2General4Patch5PoC1 |
| 2026-05-13 | 11 | Active Exploitation2Disclosure3General3Patch3 |
| 2026-05-14 | 9 | Disclosure2Exploit1General3Patch3 |
| 2026-05-15 | 6 | Disclosure1General2Patch1PoC2 |
| 2026-05-16 | 3 | General2Patch1 |
| 2026-05-18 | 6 | Disclosure4General2 |
| 2026-05-20 | 1 | PoC1 |
| 2026-05-22 | 2 | General2 |
| 2026-05-25 | 1 | Patch1 |
| 2026-05-26 | 1 | Disclosure1 |
| 2026-05-27 | 1 | Disclosure1 |
| 2026-05-28 | 1 | General1 |
| 2026-06-01 | 1 | General1 |
| 2026-06-02 | 1 | Active Exploitation1 |
| 2026-06-07 | 2 | Disclosure2 |
| 2026-06-14 | 1 | General1 |
| 2026-06-15 | 3 | Disclosure2Patch1 |
| 2026-06-21 | 1 | PoC1 |
| 2026-06-26 | 2 | Disclosure1Exploit1 |
| 2026-06-27 | 1 | General1 |
| 2026-07-29 | 1 | PoC1 |
| 2026-07-30 | 1 | Patch1 |
| 2026-08-14 | 1 | Active Exploitation1 |
| 2026-09-16 | 1 | PoC1 |
2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
The text merely lists a set of Linux CVEs in the context of a password reset tutorial, providing no technical details, exploits, or mitigation information.
Linux 重置密码大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300) -PinTheft (CVE-2026-43494)
Post summary
The text is a generic list of Linux kernel CVEs related to password reset techniques, providing no further details on exploits, patches, or active usage.
Them: Linux is most secure OS Me: Yes - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)
Post summary
The text lists several known Linux kernel CVEs, highlighting weaknesses rather than providing new details, patch information, or evidence of exploitation.
記憶バッファに収まらないんですが…… ・Copy Fail / CVE-2026-31431 ・Dirty Frag / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300
Post summary
The text merely lists CVE identifiers without providing additional technical, exploit, or mitigation details.
A newly disclosed Linux local privilege escalation vulnerability known as “Dirty Frag” enables escalation from an unprivileged user to root through vulnerable kernel networking and memory-fragment handling components, including esp4, esp6 (CVE-2026-43284), and rxrpc (CVE-2026-43500). Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability. Get technical details, exploit scenarios, and mitigation and detection guidance from this Microsoft Defender Research blog: https://msft.it/6015v3WNc
Post summary
The text announces the newly disclosed Linux local privilege escalation vulnerability ‘Dirty Frag’, provides technical details and mitigation guidance, but does not reveal an active exploit or code.
Linuxカーネルの権限昇格の脆弱性「DirtyClone」が公開され、JFrog Security Researchは6月25日に動作するエクスプロイトを公開した。CVE-2026-43503が割り当てられており、ローカルユーザーがroot権限を取得できる可能性がある。 原因は、ネットワークパケットを複製する際に、ファイルと共有されているメモリを示すフラグが失われることにある。攻撃者はIPsec経由で複製されたパケットを利用し、メモリ上に読み込まれた/usr/bin/suなどの実行ファイルを書き換え、次回実行時にroot権限を取得できる。 変更はディスク上のファイルには反映されず、カーネルのページキャッシュ内だけで発生するため、ファイル整合性チェックでは検出されず、再起動すると元に戻るという。 攻撃にはCAP_NET_ADMIN権限が必要だが、DebianやFedoraではデフォルトで有効な非特権ユーザー名前空間を利用して取得できる。一方、Ubuntu 24.04以降ではAppArmorにより標準的な攻撃手法は制限される。 DirtyCloneは、Copy Fail（CVE-2026-31431）、DirtyFrag（CVE-2026-43284、CVE-2026-43500）、Fragnesia（CVE-2026-46300）に続く4件目の関連脆弱性となる。修正は5月21日にメインラインへ取り込まれ、Linux v7.1-rc5以降および安定版・LTSへバックポートされている。更新できない場合は、非特権ユーザー名前空間を無効化するか、IPsec関連モジュールを無効化することで攻撃面を減らせるとしている。 https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html
Post summary
The text reports JFrog's release of a working exploit for the DirtyClone Linux kernel privilege‑escalation CVE‑2026‑43503, details the IPsec‑based attack technique, and confirms that patches and mitigation steps are already available.
Diving into Dirty Frag, the second Linux page-cache local privesc in two weeks. CVE-2026-43284 + CVE-2026-43500 provide full distro coverage. I walk through both variants, the broken disclosure, and demo both versions on the HTB Snapped machine. https://www.youtube.com/watch?v=B5eUI_e7iwE
Post summary
The post showcases a demonstration of the Dirty Frag local privilege escalation on a HTB machine via a YouTube video, confirming the existence of a PoC but lacking active exploitation references or patch details.
‼️ Dirty Frag: A Universal Linux Local Privilege Escalation via Page-Cache Write Primitives GitHub: https://github.com/V4bel/dirtyfrag Patches: https://almalinux.org/blog/2026-05-07-dirty-frag/ CVE-2026-43284: A page-cache write flaw in the Linux kernel's xfrm-ESP (IPsec) subsystem that lets a local user corrupt read-only file pages via in-place decryption on shared skb fragments CVE-2026-43500: A sibling page-cache write flaw in the Linux kernel's RxRPC subsystem (AFS protocol) where the same fast-path pattern enables arbitrary plaintext writes into attacker-chosen pages, escalating to root
Post summary
A universal Linux local privilege escalation vulnerability, CVE‑2026‑43284 and CVE‑2026‑43500, is disclosed with a GitHub PoC and patches released, but no active exploitation reports are mentioned.
https://www.linkedin.com/pulse/load-bearing-assumptions-rxrpc-case-cve-2026-43500-never-oldani-uzyae/
Post summary
The provided text only includes a URL with no explicit details about the CVE; thus no actionable indicators can be inferred.
Another day, another Linux CVE. Truly wild times. So here's umbrelOS 1.7.3 which patches DirtyFrag (CVE-2026-43284 and CVE-2026-43500). The vulnerability hits the news. You hit "Install now" and you're already patched. You're welcome. 🤝 https://t.co/ZuQQigLjdO
Post summary
umbrelOS 1.7.3 releases an update that patches the DirtyFrag CVEs CVE‑2026‑43284 and CVE‑2026‑43500, automatically applying the fix upon installation.
Last week in Linux: CVE-2026-43485: nouveau/gsp: drop WARN_ON in ACPI probes 2026-05-13 15:08 UTC CVE-2026-43484: mmc: core: Avoid bitfield RMW for claim/retune flags 2026-05-13 15:08 UTC CVE-2026-43483: KVM: SVM: Set/clear CR8 write interception when AVIC is (de)activated 2026-05-13 15:08 UTC CVE-2026-43482: sched_ext: Disable preemption between scx_claim_exit() and kicking helper work 2026-05-13 15:08 UTC CVE-2026-43481: net-shapers: don't free reply skb after genlmsg_reply() 2026-05-13 15:08 UTC CVE-2026-43480: ASoC: amd: acp3x-rt5682-max9836: Add missing error check for clock acquisition 2026-05-13 15:08 UTC CVE-2026-43479: net: usb: lan78xx: fix WARN in __netif_napi_del_locked on disconnect 2026-05-13 15:08 UTC CVE-2026-43478: ASoC: codecs: rt1011: Use component to get the dapm context in spk_mode_put 2026-05-13 15:08 UTC CVE-2026-43489: liveupdate: luo_file: remember retrieve() status 2026-05-13 15:08 UTC CVE-2026-43488: usb: xhci: Prevent interrupt storm on host controller error (HCE) 2026-05-13 15:08 UTC CVE-2026-43487: ata: libata-core: Disable LPM on ST1000DM010-2EP102 2026-05-13 15:08 UTC CVE-2026-43486: arm64: contpte: fix set_access_flags() no-op check for SMMU/ATS faults 2026-05-13 15:08 UTC CVE-2026-43476: iio: chemical: sps30_i2c: fix buffer size in sps30_i2c_read_meas() 2026-05-13 15:08 UTC CVE-2026-43477: drm/i915/vrr: Configure VRR timings after enabling TRANS_DDI_FUNC_CTL 2026-05-13 15:08 UTC CVE-2026-43500: rxrpc: Also unshare DATA/RESPONSE packets when paged frags are present 2026-05-11 6:26 UTC CVE-2026-43452: netfilter: x_tables: guard option walkers against 1-byte tail reads 2026-05-08 14:23 UTC CVE-2026-43461: spi: amlogic: spifc-a4: Fix DMA mapping error handling 2026-05-08 14:23 UTC CVE-2026-43460: spi: rockchip-sfc: Fix double-free in remove() callback 2026-05-08 14:23 UTC CVE-2026-43459: ASoC: soc-core: flush delayed work before removing DAIs and widgets 2026-05-08 14:23 UTC CVE-2026-43458: serial: caif: hold tty->link reference in ldisc_open and ser_release 2026-05-08 14:23 UTC CVE-2026-43457: mctp: i2c: fix skb memory leak in receive path 2026-05-08 14:23 UTC CVE-2026-43456: bonding: fix type confusion in bond_setup_by_slave() 2026-05-08 14:23 UTC CVE-2026-43455: mctp: route: hold key->lock in mctp_flow_prepare_output() 2026-05-08 14:23 UTC CVE-2026-43475: scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT 2026-05-08 14:23 UTC CVE-2026-43474: fs: init flags_valid before calling vfs_fileattr_get 2026-05-08 14:23 UTC CVE-2026-43473: scsi: mpi3mr: Add NULL checks when resetting request and reply queues 2026-05-08 14:23 UTC CVE-2026-43472: unshare: fix unshare_fs() handling 2026-05-08 14:23 UTC CVE-2026-43454: netfilter: nf_tables: Fix for duplicate device in netdev hooks 2026-05-08 14:23 UTC CVE-2026-43471: scsi: ufs: core: Fix possible NULL pointer dereference in ufshcd_add_command_trace() 2026-05-08 14:23 UTC CVE-2026-43470: nfs: return EISDIR on nfs3_proc_create if d_alias is a dir 2026-05-08 14:23 UTC CVE-2026-43469: xprtrdma: Decrement re_receiving on the early exit paths 2026-05-08 14:23 UTC CVE-2026-43468: net/mlx5: Fix deadlock between devlink lock and esw->wq 2026-05-08 14:23 UTC CVE-2026-43467: net/mlx5: Fix crash when moving to switchdev mode 2026-05-08 14:23 UTC CVE-2026-43466: net/mlx5e: Fix DMA FIFO desync on error CQE SQ recovery 2026-05-08 14:23 UTC CVE-2026-43465: net/mlx5e: RX, Fix XDP multi-buf frag counting for striding RQ 2026-05-08 14:23 UTC CVE-2026-43464: net/mlx5e: RX, Fix XDP multi-buf frag counting for legacy RQ 2026-05-08 14:23 UTC CVE-2026-43463: rxrpc, afs: Fix missing error pointer check after rxrpc_kernel_lookup_peer() 2026-05-08 14:23 UTC CVE-2026-43462: net: spacemit: Fix error handling in emac_tx_mem_map() 2026-05-08 14:23 UTC CVE-2026-43453: netfilter: nft_set_pipapo: fix stack out-of-bounds read in pipapo_drop() 2026-05-08 14:23 UTC CVE-2026-43417: sched/mmcid: Handle vfork()/CLONE_VM correctly 2026-05-08 14:22 UTC CVE-2026-43426: usb: renesas_usbhs: fix use-after-free in ISR during device removal 2026-05-08 14:22 UTC CVE-2026-43425: usb: image: mdc800: kill download URB on timeout 2026-05-08 14:22 UTC CVE-2026-43424: usb: gadget: f_tcm: Fix NULL pointer dereferences in nexus handling 2026-05-08 14:22 UTC CVE-2026-43423: usb: gadget: f_ncm: Fix atomic context locking issue 2026-05-08 14:22 UTC CVE-2026-43422: usb: legacy: ncm: Fix NPE in gncm_bind 2026-05-08 14:22 UTC CVE-2026-43421: usb: gadget: f_ncm: Fix net_device lifecycle with device_move 2026-05-08 14:22 UTC CVE-2026-43451: netfilter: nfnetlink_queue: fix entry leak in bridge verdict error path 2026-05-08 14:23 UTC CVE-2026-43450: netfilter: nfnetlink_cthelper: fix OOB read in nfnl_cthelper_dump_table() 2026-05-08 14:22 UTC CVE-2026-43449: nvme-pci: Fix slab-out-of-bounds in nvme_dbbuf_set 2026-05-08 14:22 UTC CVE-2026-43448: nvme-pci: Fix race bug in nvme_poll_irqdisable() 2026-05-08 14:22 UTC CVE-2026-43447: iavf: fix PTP use-after-free during reset 2026-05-08 14:22 UTC CVE-2026-43420: ceph: fix i_nlink underrun during async unlink 2026-05-08 14:22 UTC CVE-2026-43446: accel/amdxdna: Fix runtime suspend deadlock when there is pending job 2026-05-08 14:22 UTC CVE-2026-43445: e1000/e1000e: Fix leak in DMA error cleanup 2026-05-08 14:22 UTC CVE-2026-43444: drm/amdkfd: Unreserve bo if queue update failed 2026-05-08 14:22 UTC CVE-2026-43443: ASoC: amd: acp-mach-common: Add missing error check for clock acquisition 2026-05-08 14:22 UTC CVE-2026-43442: io_uring: fix physical SQE bounds check for SQE_MIXED 128-byte ops 2026-05-08 14:22 UTC CVE-2026-43441: net: bonding: Fix nd_tbl NULL dereference when IPv6 is disabled 2026-05-08 14:22 UTC CVE-2026-43440: net/mana: Null service_wq on setup error to prevent double destroy 2026-05-08 14:22 UTC CVE-2026-43439: cgroup: fix race between task migration and iteration 2026-05-08 14:22 UTC CVE-2026-43438: sched_ext: Remove redundant css_put() in scx_cgroup_init() 2026-05-08 14:22 UTC CVE-2026-43437: ALSA: pcm: fix use-after-free on linked stream runtime in snd_pcm_drain() 2026-05-08 14:22 UTC CVE-2026-43419: ceph: fix memory leaks in ceph_mdsc_build_path() 2026-05-08 14:22 UTC CVE-2026-43436: ALSA: usb-audio: Check endpoint numbers at parsing Scarlett2 mixer interfaces 2026-05-08 14:22 UTC CVE-2026-43435: rust_binder: fix oneway spam detection 2026-05-08 14:22 UTC CVE-2026-43434: rust_binder: check ownership before using vma 2026-05-08 14:22 UTC CVE-2026-43433: rust_binder: avoid reading the written value in offsets array 2026-05-08 14:22 UTC CVE-2026-43432: usb: xhci: Fix memory leak in xhci_disable_slot() 2026-05-08 14:22 UTC CVE-2026-43431: xhci: Fix NULL pointer dereference when reading portli debugfs files 2026-05-08 14:22 UTC CVE-2026-43430: usb: yurex: fix race in probe 2026-05-08 14:22 UTC CVE-2026-43429: USB: usbtmc: Use usb_bulk_msg_killable() with user-specified timeouts 2026-05-08 14:22 UTC CVE-2026-43428: USB: core: Limit the length of unkillable synchronous timeouts 2026-05-08 14:22 UTC CVE-2026-43427: usb: class: cdc-wdm: fix reordering issue in read code path 2026-05-08 14:22 UTC CVE-2026-43418: sched/mmcid: Prevent CID stalls due to concurrent forks 2026-05-08 14:22 UTC CVE-2026-43383: net/tcp-md5: Fix MAC comparison to be constant-time 2026-05-08 14:21 UTC CVE-2026-43392: sched_ext: Fix starvation of scx_enable() under fair-class saturation 2026-05-08 14:22 UTC CVE-2026-43391: nsfs: tighten permission checks for handle opening 2026-05-08 14:22 UTC CVE-2026-43390: nstree: tighten permission checks for listing 2026-05-08 14:21 UTC CVE-2026-43389: mm: memfd_luo: always dirty all folios 2026-05-08 14:21 UTC CVE-2026-43388: mm/damon/core: clear walk_control on inactive context in damos_walk() 2026-05-08 14:21 UTC CVE-2026-43387: staging: rtl8723bs: properly validate the data in rtw_get_ie_ex() 2026-05-08 14:21 UTC CVE-2026-43416: powerpc, perf: Check that current->mm is alive before getting user callchain 2026-05-08 14:22 UTC CVE-2026-43415: scsi: ufs: core: Fix SError in ufshcd_rtc_work() during UFS suspend 2026-05-08 14:22 UTC CVE-2026-43414: scsi: qla2xxx: Completely fix fcport double free 2026-05-08 14:22 UTC CVE-2026-43413: scsi: hisi_sas: Fix NULL pointer exception during user_scan() 2026-05-08 14:22 UTC CVE-2026-43386: staging: rtl8723bs: fix potential out-of-bounds read in rtw_restruct_wmm_ie 2026-05-08 14:21 UTC CVE-2026-43412: ASoC: qcom: qdsp6: Fix q6apm remove ordering during ADSP stop and start 2026-05-08 14:22 UTC CVE-2026-43411: tipc: fix divide-by-zero in tipc_sk_filter_connect() 2026-05-08 14:22 UTC CVE-2026-43410: firmware: stratix10-rsu: Fix NULL pointer dereference when RSU is disabled 2026-05-08 14:22 UTC CVE-2026-43409: kprobes: avoid crash when rmmod/insmod after ftrace killed 2026-05-08 14:22 UTC CVE-2026-43408: ceph: add a bunch of missing ceph_path_info initializers 2026-05-08 14:22 UTC CVE-2026-43407: libceph: Fix potential out-of-bounds access in ceph_handle_auth_reply() 2026-05-08 14:22 UTC CVE-2026-43406: libceph: prevent potential out-of-bounds reads in process_message_header() 2026-05-08 14:22 UTC CVE-2026-43405: libceph: Use u32 for non-negative values in ceph_monmap_decode() 2026-05-08 14:22 UTC CVE-2026-43404: mm: Fix a hmm_range_fault() livelock / starvation problem 2026-05-08 14:22 UTC CVE-2026-43403: nsfs: tighten permission checks for ns iteration ioctls 2026-05-08 14:22 UTC CVE-2026-43385: net: Fix rcu_tasks stall in threaded busypoll 2026-05-08 14:21 UTC CVE-2026-43402: kthread: consolidate kthread exit paths to prevent use-after-free 2026-05-08 14:22 UTC CVE-2026-43401: cpufreq: intel_pstate: Fix NULL pointer dereference in update_cpu_qos_request() 2026-05-08 14:22 UTC CVE-2026-43400: drm/amdgpu: add upper bound check on user inputs in signal ioctl 2026-05-08 14:22 UTC CVE-2026-43399: drm/amdgpu/userq: Fix reference leak in amdgpu_userq_wait_ioctl 2026-05-08 14:22 UTC CVE-2026-43398: drm/amdgpu: add upper bound check on user inputs in wait ioctl 2026-05-08 14:22 UTC CVE-2026-43397: drm/bridge: samsung-dsim: Fix memory leak in error path 2026-05-08 14:22 UTC CVE-2026-43396: drm/xe/sync: Fix user fence leak on alloc failure 2026-05-08 14:22 UTC CVE-2026-43395: drm/xe/sync: Cleanup partially initialized sync on parse failure 2026-05-08 14:22 UTC CVE-2026-43394: nfsd: Fix cred ref leak in nfsd_nl_listener_set_doit() 2026-05-08 14:22 UTC CVE-2026-43393: btrfs: fix chunk map leak in btrfs_map_block() after btrfs_chunk_map_num_copies() 2026-05-08 14:22 UTC CVE-2026-43384: net/tcp-ao: Fix MAC comparison to be constant-time 2026-05-08 14:21 UTC CVE-2026-43360: btrfs: fix transaction abort on file creation due to name hash collision 2026-05-08 14:21 UTC CVE-2026-43359: btrfs: fix transaction abort on set received ioctl due to item overflow 2026-05-08 14:21 UTC CVE-2026-43358: btrfs: add missing RCU unlock in error path in try_release_subpage_extent_buffer() 2026-05-08 14:21 UTC CVE-2026-43357: iio: gyro: mpu3050-core: fix pm_runtime error handling 2026-05-08 14:21 UTC CVE-2026-43356: iio: imu: adis: Fix NULL pointer dereference in adis_init 2026-05-08 14:21 UTC CVE-2026-43355: iio: light: bh1780: fix PM runtime leak on error path 2026-05-08 14:21 UTC CVE-2026-43382: batman-adv: Avoid double-rtnl_lock ELP metric worker 2026-05-08 14:21 UTC CVE-2026-43381: nouveau/dpcd: return EBUSY for aux xfer if the device is asleep 2026-05-08 14:21 UTC CVE-2026-43354: iio: proximity: hx9023s: Protect against division by zero in set_samp_freq 2026-05-08 14:21 UTC CVE-2026-43380: hwmon: (pmbus/q54sj108a2) fix stack overflow in debugfs read 2026-05-08 14:21 UTC CVE-2026-43379: ksmbd: fix use-after-free in smb_lazy_parent_lease_break_close() 2026-05-08 14:21 UTC CVE-2026-43378: smb: server: fix use-after-free in smb2_open() 2026-05-08 14:21 UTC CVE-2026-43377: ksmbd: Don't log keys in SMB3 signing and encryption key generation 2026-05-08 14:21 UTC CVE-2026-43376: ksmbd: fix use-after-free by using call_rcu() for oplock_info 2026-05-08 14:21 UTC CVE-2026-43375: net: mctp: fix device leak on probe failure 2026-05-08 14:21 UTC CVE-2026-43374: net: nexthop: fix percpu use-after-free in remove_nh_grp_entry 2026-05-08 14:21 UTC CVE-2026-43373: net: ncsi: fix skb leak in error paths 2026-05-08 14:21 UTC CVE-2026-43372: net: dsa: microchip: Fix error path in PTP IRQ setup 2026-05-08 14:21 UTC CVE-2026-43371: net: macb: Shuffle the tx ring before enabling tx 2026-05-08 14:21 UTC CVE-2026-43353: i3c: mipi-i3c-hci: Fix race in DMA ring dequeue 2026-05-08 14:21 UTC CVE-2026-43370: drm/amdgpu: Fix use-after-free race in VM acquire 2026-05-08 14:21 UTC CVE-2026-43369: drm/amd: Fix NULL pointer dereference in device cleanup 2026-05-08 14:21 UTC CVE-2026-43368: drm/i915: Fix potential overflow of shmem scatterlist length 2026-05-08 14:21 UTC CVE-2026-43367: drm/amd: Fix a few more NULL pointer dereference in device cleanup 2026-05-08 14:21 UTC CVE-2026-43366: io_uring/kbuf: check if target buffer list is still legacy on recycle 2026-05-08 14:21 UTC CVE-2026-43365: xfs: fix undersized l_iclog_roundoff values 2026-05-08 14:21 UTC CVE-2026-43364: ublk: fix NULL pointer dereference in ublk_ctrl_set_size() 2026-05-08 14:21 UTC CVE-2026-43363: x86/apic: Disable x2apic on resume if the kernel expects so 2026-05-08 14:21 UTC CVE-2026-43362: smb: client: fix in-place encryption corruption in SMB2_write() 2026-05-08 14:21 UTC CVE-2026-43361: btrfs: fix transaction abort when snapshotting received subvolumes 2026-05-08 14:21 UTC CVE-2026-43351: KVM: arm64: Eagerly init vgic dist/redist on vgic creation 2026-05-08 14:21 UTC CVE-2026-43352: i3c: mipi-i3c-hci: Correct RING_CTRL_ABORT handling in DMA dequeue 2026-05-08 14:21 UTC CVE-2026-43350: smb: client: require a full NFS mode SID before reading mode bits 2026-05-08 13:41 UTC CVE-2026-43348: mshv_vtl: Fix vmemmap_shift exceeding MAX_FOLIO_ORDER 2026-05-08 13:41 UTC CVE-2026-43349: f2fs: fix to avoid uninit-value access in f2fs_sanity_check_node_footer 2026-05-08 13:41 UTC CVE-2026-43347: arm64: dts: qcom: monaco: Reserve full Gunyah metadata region 2026-05-08 13:39 UTC CVE-2026-43346: ice: ptp: don't WARN when controlling PF is unavailable 2026-05-08 13:39 UTC CVE-2026-43344: perf/x86/intel/uncore: Fix die ID init and look up bugs 2026-05-08 13:39 UTC CVE-2026-43345: net: ipa: fix event ring index not programmed for IPA v5.0+ 2026-05-08 13:39 UTC CVE-2026-43343: usb: gadget: f_subset: Fix unbalanced refcnt in geth_free 2026-05-08 13:37 UTC CVE-2026-43342: usb: gadget: f_rndis: Protect RNDIS options with mutex 2026-05-08 13:37 UTC CVE-2026-43340: comedi: Reinit dev->spinlock between attachments to low-level drivers 2026-05-08 13:37 UTC CVE-2026-43341: net/ipv6: ioam6: prevent schema length wraparound in trace fill 2026-05-08 13:37 UTC CVE-2026-43321: bpf: Properly mark live registers for indirect jumps 2026-05-08 13:26 UTC CVE-2026-43320: drm/amd/display: Fix dsc eDP issue 2026-05-08 13:26 UTC CVE-2026-43319: spi: spidev: fix lock inversion between spi_lock and buf_lock 2026-05-08 13:26 UTC CVE-2026-43318: drm/amdgpu: fix sync handling in amdgpu_dma_buf_move_notify 2026-05-08 13:26 UTC CVE-2026-43317: most: core: fix leak on early registration failure 2026-05-08 13:26 UTC CVE-2025-71302: drm/panthor: fix for dma-fence safe access rules 2026-05-08 13:26 UTC CVE-2026-43316: media: solo6x10: Check for out of bounds chip_id 2026-05-08 13:26 UTC CVE-2025-71300: Revert "arm64: zynqmp: Add an OP-TEE node to the device tree" 2026-05-08 13:15 UTC CVE-2025-71301: drm/tests: shmem: Hold reservation lock around vmap/vunmap 2026-05-08 13:15 UTC CVE-2026-43314: dm: remove fake timeout to avoid leak request 2026-05-08 13:12 UTC CVE-2026-43315: KVM: nSVM: Remove a user-triggerable WARN on nested_svm_load_cr3() succeeding 2026-05-08 13:12 UTC CVE-2026-43290: media: uvcvideo: Return queued buffers on start_streaming() failure 2026-05-08 13:11 UTC CVE-2026-43289: kexec: derive purgatory entry from symbol 2026-05-08 13:11 UTC CVE-2026-43288: ext4: move ext4_percpu_param_init() before ext4_mb_init() 2026-05-08 13:11 UTC CVE-2026-43287: drm: Account property blob allocations to memcg 2026-05-08 13:11 UTC CVE-2026-43286: mm/hugetlb: restore failed global reservations to subpool 2026-05-08 13:11 UTC CVE-2026-43285: mm/slab: do not access current->mems_allowed_seq if !allow_spin 2026-05-08 13:11 UTC CVE-2026-43313: ACPI: processor: Fix NULL-pointer dereference in acpi_processor_errata_piix4() 2026-05-08 13:12 UTC CVE-2026-43312: media: i2c: ov5647: Initialize subdev before controls 2026-05-08 13:12 UTC CVE-2026-43311: soc/tegra: pmc: Fix unsafe generic_handle_irq() call 2026-05-08 13:12 UTC CVE-2025-71299: spi: cadence-quadspi: Parse DT for flashes with the rest of the DT parsing 2026-05-08 13:11 UTC CVE-2026-43310: media: verisilicon: Avoid G2 bus error while decoding H.264 and HEVC 2026-05-08 13:12 UTC CVE-2026-43309: md raid: fix hang when stopping arrays with metadata through dm-raid 2026-05-08 13:12 UTC CVE-2026-43308: btrfs: don't BUG() on unexpected delayed ref type in run_one_delayed_ref() 2026-05-08 13:12 UTC CVE-2026-43307: iio: accel: adxl380: Avoid reading more entries than present in FIFO 2026-05-08 13:12 UTC CVE-2026-43306: bpf: crypto: Use the correct destructor kfunc type 2026-05-08 13:12 UTC CVE-2026-43305: drm/amd/display: Fix mismatched unlock for DMUB HW lock in HWSS fast path 2026-05-08 13:12 UTC CVE-2026-43304: libceph: define and enforce CEPH_MAX_KEY_LEN 2026-05-08 13:12 UTC CVE-2026-43303: mm/page_alloc: clear page->private in free_pages_prepare() 2026-05-08 13:12 UTC CVE-2026-43302: drm/v3d: Set DMA segment size to avoid debug warnings 2026-05-08 13:12 UTC CVE-2026-43301: media: chips-media: wave5: Fix PM runtime usage count underflow 2026-05-08 13:12 UTC CVE-2025-71298: drm/tests: shmem: Hold reservation lock around madvise 2026-05-08 13:11 UTC CVE-2026-43300: drm/panel: Fix a possible null-pointer dereference in jdi_panel_dsi_remove() 2026-05-08 13:12 UTC CVE-2026-43299: btrfs: do not ASSERT() when the fs flips RO inside btrfs_repair_io_failure() 2026-05-08 13:12 UTC CVE-2026-43298: drm/amdgpu: Skip vcn poison irq release on VF 2026-05-08 13:12 UTC CVE-2026-43297: media: rockchip: rga: Fix possible ERR_PTR dereference in rga_buf_init() 2026-05-08 13:12 UTC CVE-2026-43296: octeontx2-af: Workaround SQM/PSE stalls by disabling sticky 2026-05-08 13:12 UTC CVE-2026-43295: rapidio: replace rio_free_net() with kfree() in rio_scan_alloc_net() 2026-05-08 13:12 UTC CVE-2026-43294: drm: renesas: rz-du: mipi_dsi: fix kernel panic when rebooting for some panels 2026-05-08 13:11 UTC CVE-2026-43293: media: chips-media: wave5: Fix kthread worker destruction in polling mode 2026-05-08 13:11 UTC CVE-2026-43292: mm/vmalloc: prevent RCU stalls in kasan_release_vmalloc_node 2026-05-08 13:11 UTC CVE-2026-43291: net: nfc: nci: Fix parameter validation for packet data 2026-05-08 13:11 UTC CVE-2025-71296: drm/tests: shmem: Hold reservation lock around purge 2026-05-08 13:11 UTC CVE-2025-71297: wifi: rtw88: 8822b: Avoid WARNING in rtw8822b_config_trx_mode() 2026-05-08 13:11 UTC CVE-2026-43284: xfrm: esp: avoid in-place decrypt on shared skb frags 2026-05-08 7:21 UTC CVE-2025-71285: net: qrtr: Drop the MHI auto_queue feature for IPCR DL channels 2026-05-06 11:32 UTC CVE-2025-71294: drm/amdgpu: fix NULL pointer issue buffer funcs 2026-05-06 11:32 UTC CVE-2025-71293: drm/amdgpu/ras: Move ras data alloc before bad page check 2026-05-06 11:32 UTC CVE-2025-71292: jfs: nlink overflow in jfs_rename 2026-05-06 11:32 UTC
Post summary
The text is a list of Linux kernel CVE entries with brief fix notes, indicating new vulnerability disclosures and associated patches but no exploitation or PoC information.
🚨 Meet "Dirty Frag": a new Linux kernel privilege escalation, fresh off the heels of Copy Fail. Wiz Research is tracking CVE-2026-43284 and CVE-2026-43500 (also known as Copy Fail 2), discovered by Hyunwoo Kim (@v4bel). No official patches are out yet, and a public PoC already exists. 🔑 The technical bit: A vulnerability chain in the ESP (IPsec) and RxRPC kernel subsystems, with two deterministic page-cache write primitives in the same spirit as Dirty Pipe. Ubuntu, RHEL 8/9/10, AlmaLinux, Fedora, openSUSE, and more are all affected. 🛡️ Slightly less risky for containers: Exploitation usually requires CAP_NET_ADMIN, so hardened Kubernetes setups with default seccomp profiles are at lower risk. VMs and less restricted environments should still take this seriously. 🔧 What to do now: Until patches drop, you can temporarily disable the vulnerable kernel modules (esp4, esp6, rxrpc). Full mitigation and detection guidance in the blog. Wiz customers: pre-built queries and a live advisory are already in the Threat Intel Center. We'll keep updating both as more info comes to light. Full research from Merav Bar and @ramimacisabird: https://www.wiz.io/blog/dirty-frag-linux-kernel-local-privilege-escalation-via-esp-and-rxrpc
Post summary
Wiz Research discloses a new Linux kernel privilege escalation (CVE‑2026‑43284/43500) with a public PoC available; no active exploitation reported, and temporary mitigation of disabling kernel modules is advised until patches are released.
Excellent article en français sur la faille Dirty Frag aka la double CVE-2026-43284 et CVE-2026-43500 ! Je vous recommande grandement sa lecture ! https://blog.marcfredericgomez.fr/dirty-frag-cve-2026-43284-et-cve-2026-43500/ #Linux #LPE #DirtyFrag
Post summary
The tweet merely points to an article discussing the Dirty Frag vulnerability (CVE-2026-43284 and CVE-2026-43500) without providing PoC, exploit details, patches, or technical specifics.
⚠️ A threat actor is advertising an alleged Linux privilege escalation exploit dubbed “Dirty Frag,” claiming it targets: • CVE-2026-43284 • CVE-2026-43500 According to the forum post, the claimed exploit allegedly abuses: • Linux kernel memory fragmentation handling • Network stack processing mechanisms • Page cache manipulation • IPsec (ESP4/ESP6) components • RxRPC-related functionality The actor claims the technique enables: • Stable local privilege escalation to root • Container escape scenarios • Post-exploitation privilege escalation • Deterministic exploitation without race-condition dependency The post further claims potential effectiveness against: • RHEL • Ubuntu • CentOS • Fedora • AlmaLinux • OpenShift environments At this time: • The claims remain unverified • Public technical validation is currently unavailable • There is no confirmation regarding real-world exploitation activity • The reliability and impact of the alleged exploit are unknown Kernel-level privilege escalation vulnerabilities are particularly dangerous because they can: • Bypass container isolation • Enable persistence • Facilitate lateral movement • Disable security tooling • Escalate low-privileged access into full system compromise Organizations should consider: • Monitoring for emerging advisories and proof-of-concept releases • Reviewing kernel patch status • Restricting unnecessary kernel modules and services • Monitoring for suspicious privilege escalation activity • Applying least-privilege controls and hardening container environments Daily Dark Web is monitoring underground forums and related channels for additional technical details, proof-of-concept material, or exploitation evidence tied to the alleged vulnerabilities. #DDW #Intelligence #CyberSecurity #Linux #Kernel #PrivilegeEscalation #Exploit #CVE #ThreatIntelligence #VulnerabilityResearch
Post summary
An unverified claim of a Linux kernel privilege escalation exploit targeting CVE-2026-43284 and CVE-2026-43500 is reported, with no proven PoC, active exploitation, or patch, and only general technical details provided.
The Dirty Frag Linux vulnerability (CVE-2026-43284 & CVE-2026-43500) is being actively exploited in the wild. Learn how to secure your servers from this root LPE exploit. #DirtyFrag #LinuxSecurity #CyberSecurity #ZeroDay #Vulnerability #ExploitInTheWild https://securityonline.info/dirty-frag-linux-vulnerability-exploited-in-the-wild-root-access/ https://t.co/U6K6y1hFiy
Post summary
The post asserts that CVE‑2026‑43284 and CVE‑2026‑43500 are actively exploited in the wild as a root privilege escalation vulnerability, but it provides no known PoC, exploit code, or specific patch details.
Linuxのカーネルまわりの脆弱性（最近のやつ）の整理（as of 5月18日） ・Copy Fail / CVE-2026-31431 ・Dirty Frag (Copy Fail 2) / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300 ・DirtyDecrypt (Fragnesia亜種) LPE連打が厄介。
Post summary
The post lists recent Linux kernel CVEs with their categories but offers no PoC, exploit code, patch information, or evidence of active exploitation.
No hay una 3ª vulnerabilidad de elevación universal en el Kernel. CopyFail2/electric boogaloo es Dirty Frag con otra fórmula de explotación. * CopyFail: CVE-2026-31431 * Dirty Frag: CVE-2026-43284/CVE-2026-43500 * CopyFail2: centrada en CVE-2026-43284, exploit menos fiable. Hilo¬
Post summary
The post refutes the existence of a supposed third kernel privilege‑elevation vulnerability while naming other CVEs, but it offers no PoC, exploit code, or patch information.
Linuxのカーネルまわりの脆弱性（最近のやつ）の整理： ・Copy Fail / CVE-2026-31431 ・Dirty Frag / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300 ・Fragnesia亜種 / CVE未採番 <- 5/16（日本時間）に登場した新種 たいていのディストリビューションで対処済みなのはFragnesiaまでで、最新のやつはどうなってるかケースバイケースです……。
Post summary
The text lists recent Linux kernel CVEs, notes that most distributions have patched vulnerabilities up to Fragnesia, and remarks that the status of the newest CVEs varies by case.
Unraid OS 7.2.6 is now available. This is an important security release that upgrades the Linux kernel to address the "Dirty Frag" local privilege escalation vulnerability (CVE-2026-43284 & CVE-2026-43500). All users should update their systems immediately to stay protected.
Post summary
A new Unraid OS 7.2.6 update patches the Dirty Frag local privilege escalation CVEs (CVE‑2026‑43284 & CVE‑2026‑43500); users should update immediately.
A new Linux kernel vulnerability is making rounds in May 2026. It is called Dirty Frag. The CVEs are real. The risk is real. And the nuance matters. CVE-2026-43284 and CVE-2026-43500 chain together flaws in kernel memory handling to give an unprivileged local user a path to full root access. Microsoft Security Research, Red Hat, CloudLinux, and Wiz have all published advisories. Proof-of-concept exploit code is publicly available. Here is what the hype gets wrong. This is a local privilege escalation, not a remote attack. An attacker cannot point this at your server from the internet and own it. They need a foothold first. A shell. A low-privilege account. Code execution on the machine. That distinction matters because it changes the threat model. The real danger is chaining. A phishing hit on a developer. A compromised CI runner. A container breakout. A misconfigured service running as a low-privilege user. Any of those become a full root compromise on a vulnerable kernel. Multi-user environments, containerized workloads, and shared build infrastructure carry the highest exposure here. One unprivileged process with access to a vulnerable kernel is enough. Mitigations exist while patches roll out. Disabling esp4, esp6, and rxrpc modules reduces the attack surface. Kernel updates are already appearing across major distributions. The urgency is real but so is the path forward. Unpatched kernels sitting in production with broad user access are the actual problem. Not Linux itself. My name is Azubuike Ibe and I write about this because the gap between what the headlines say and what your team actually needs to do is where real incidents happen. When did you last review kernel versions and user privilege scope across your production servers? #LinuxSecurity #KernelExploit #CyberSecurity #DevSecOps #AppSec
Post summary
The post details a disclosed Linux kernel local privilege escalation (CVE‑2026‑43284/43500), confirms public PoC code availability, emphasizes chained attack risk, and highlights available mitigations and patches.
6 of 6 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | linux | linux_kernel | - | - | - |
| OS | linux | linux_kernel | 5.3 | - | - |
| OS | linux | linux_kernel | 5.3 | - | - |
| OS | linux | linux_kernel | 5.3 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |
| OS | linux | linux_kernel | 7.1 | - | - |