Dirty Frag: A vulnerability in the Linux kernel network subsystem

Impacted Products

• CubeCOS

Introduction

This advisory covers CVE-2026-43284, CVE-2026-43500

A vulnerability in the Linux kernel network subsystem, designated as CVE-2026-43284 (informally known as part of the "Dirty Frag" vulnerability class), impacts systems utilizing the MSG_SPLICE_PAGES flag during IPsec-ESP over UDP encapsulation processing.

The security team has evaluated the default operating environment and architecture of CubeCOS against this vulnerability vector. CubeCOS is not vulnerable in its default configuration.

Description

An analysis of the CubeCOS runtime environment confirms that the prerequisite conditions required to trigger or exploit this vulnerability do not exist on the platform:

Risk Assessment and Exposure

The risk to CubeCOS users is zero, based on the following technical verification:

• IPSec/ESP functionality disallowed/disabled: CubeCOS does not utilize, configure or enable IPsec/ESP network communication. As the vulnerable decryption pathways are never initialized, the system is protected against network-driven triggers of this flaw.
• Kernel Modules Isolated: The critical kernel modules (esp4, esp6, and the xfrm framework) responsible for managing the vulnerable translation states are not loaded at runtime within CubeCOS. The subsystem code containing the flaw remains dormant in memory.
• Hardened User Access Layer:The exploit requires local, unprivileged code execution in order to trigger the underlying system calls (splice()). CubeCOS implements a hardened account policy, whereby all standard user accounts are strictly locked. Without local user access or interactive shells, the main path for local privilege escalation is blocked.

Customer Actions Required

Due to the multi-layered defenses active in CubeCOS—specifically the absence of the IPsec/XFRM runtime environment and the lack of interactive local user privileges—no immediate action is required by CubeCOS administrators.

At the time of writing, upstream kernels with the fixes are still not available. Bigstack continues to track upstream kernel patches and will incorporate them in coming release.

The fix will be included in an upcoming security patch. Customers will be notified when it is available. 

References

List

• https://nvd.nist.gov/vuln/detail/CVE-2026-43284
• https://access.redhat.com/security/cve/cve-2026-43284
• https://nvd.nist.gov/vuln/detail/CVE-2026-43500
• https://access.redhat.com/security/cve/cve-2026-43500
• https://github.com/V4bel/dirtyfrag

Change Log

Contact Us