Description
In the Linux kernel, the following vulnerability has been resolved:
xfrm: esp: avoid in-place decrypt on shared skb frags
MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP
marks such skbs with SKBFL_SHARED_FRAG after skb_splice_from_iter(),
so later paths that may modify packet data can first make a private
copy. The IPv4/IPv6 datagram append paths did not set this flag when
splicing pages into UDP skbs.
That leaves an ESP-in-UDP packet made from shared pipe pages looking
like an ordinary uncloned nonlinear skb. ESP input then takes the no-COW
fast path for uncloned skbs without a frag_list and decrypts in place
over data that is not owned privately by the skb.
Mark IPv4/IPv6 datagram splice frags with SKBFL_SHARED_FRAG, matching
TCP. Also make ESP input fall back to skb_cow_data() when the flag is
present, so ESP does not decrypt externally backed frags in place.
Private nonlinear skb frags still use the existing fast path.
This intentionally does not change ESP output. In esp_output_head(),
the path that appends the ESP trailer to existing skb tailroom without
calling skb_cow_data() is not reachable for nonlinear skbs:
skb_tailroom() returns zero when skb->data_len is nonzero, while ESP
tailen is positive. Thus ESP output will either use the separate
destination-frag path or fall back to skb_cow_data().
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linux | Linux | 4.11 | 5.10.255 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 7.0.4-1 | — |
| Debian 13 | linux | 6.12.86-1 | — |
| Debian 12 | linux | 6.1.170-3 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu Nvidia-BlueField 24.04 LTS | linux-bluefield | 6.8.0-1023.27 | — |
| Ubuntu Nvidia-BlueField 22.04 LTS | linux-bluefield | 5.15.0-1093.95 | — |
| Ubuntu 26.04 LTS | linux | 7.0.0-22.22 | USN-8370-1 |
| Ubuntu 26.04 LTS | linux-aws +1 | 7.0.0-1006.6 | USN-8370-1 |
| Ubuntu 26.04 LTS | linux-gcp +1 | 7.0.0-1005.5 | USN-8370-1 |
| Ubuntu 26.04 LTS | linux-ibm +1 | 7.0.0-1007.7 | USN-8461-1, USN-8370-1 |
| Ubuntu 26.04 LTS | linux-nvidia | 7.0.0-1009.9 | USN-8370-1 |
| Ubuntu 26.04 LTS | linux-oem-7.0 | 7.0.0-1008.8 | USN-8489-1 |
| Ubuntu 26.04 LTS | linux-raspi | 7.0.0-1011.11 | USN-8370-1 |
| Ubuntu 26.04 LTS | linux-riscv +1 | 7.0.0-22.22.1 | USN-8370-1 |
| Ubuntu 25.10 | linux | 6.17.0-35.35 | USN-8371-1 |
| Ubuntu 25.10 | linux-aws +1 | 6.17.0-1017.17 | USN-8371-1 |
| Ubuntu 25.10 | linux-azure-fde | No fix yet | — |
| Ubuntu 25.10 | linux-gcp | 6.17.0-1018.19 | USN-8374-1 |
| Ubuntu 25.10 | linux-oracle | 6.17.0-1016.16 | USN-8371-1 |
| Ubuntu 25.10 | linux-raspi | 6.17.0-1018.18 | USN-8371-1 |
| Ubuntu 25.10 | linux-realtime | 6.17.0-1014.16 | USN-8371-1 |
| Ubuntu 25.10 | linux-riscv | 6.17.0-35.35.1 | — |
| Ubuntu 24.04 LTS | linux | 6.8.0-124.124 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-aws | 6.8.0-1057.60 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-aws-6.17 +1 | 6.17.0-1017.17~24.04.1 | USN-8374-1, USN-8371-1 |
| Ubuntu 24.04 LTS | linux-azure | 6.8.0-1058.64 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-azure-fde | 6.8.0-1058.65 | — |
| Ubuntu 24.04 LTS | linux-azure-nvidia | 6.8.0-1039.42 | — |
| Ubuntu 24.04 LTS | linux-gcp | 6.8.0-1060.63 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-gcp-6.17 | 6.17.0-1018.19~24.04.1 | USN-8374-1 |
| Ubuntu 24.04 LTS | linux-gke | 6.8.0-1055.61 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-gkeop | 6.8.0-1042.45 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-hwe-6.17 | 6.17.0-35.35~24.04.1 | USN-8371-1 |
| Ubuntu 24.04 LTS | linux-hwe-7.0 | 7.0.0-28.28~24.04.1 | USN-8569-1 |
| Ubuntu 24.04 LTS | linux-ibm | 6.8.0-1057.58 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-lowlatency | 6.8.0-134.134.1 | USN-8497-1 |
| Ubuntu 24.04 LTS | linux-nvidia | 6.8.0-1055.58 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-nvidia-6.17 | 6.17.0-1021.21 | USN-8371-1 |
| Ubuntu 24.04 LTS | linux-nvidia-lowlatency | 6.8.0-1055.58.1 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-nvidia-tegra | 6.8.0-1026.26 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-oem-6.17 | 6.17.0-1024.24 | USN-8371-1 |
| Ubuntu 24.04 LTS | linux-oracle | 6.8.0-1054.55 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-oracle-6.17 | 6.17.0-1016.16~24.04.1 | USN-8371-1 |
| Ubuntu 24.04 LTS | linux-raspi | 6.8.0-1057.61 | USN-8373-1 |
| Ubuntu 24.04 LTS | linux-riscv +18 | No fix yet | — |
| Ubuntu 24.04 LTS | linux-riscv-6.17 | 6.17.0-35.35.1~24.04.1 | — |
| Ubuntu 24.04 LTS | linux-xilinx | 6.8.0-1032.33 | USN-8499-1 |
Show 17 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | linux +1 | 5.15.0-181.191 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-aws | 5.15.0-1109.116 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-aws-6.8 | 6.8.0-1057.60~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-azure +1 | 5.15.0-1114.123 | USN-8426-2 |
| Ubuntu 22.04 LTS | linux-azure-6.8 | 6.8.0-1059.65~22.04.1 | USN-8440-1 |
| Ubuntu 22.04 LTS | linux-azure-fde-6.8 | 6.8.0-1058.65~22.04.1 | — |
| Ubuntu 22.04 LTS | linux-gcp | 5.15.0-1109.118 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-gcp-6.8 | 6.8.0-1060.63~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-gke | 5.15.0-1105.111 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-gkeop | 5.15.0-1092.100 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-hwe-6.8 +1 | 6.8.0-124.124~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-ibm +1 | 5.15.0-1103.106 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-ibm-6.8 | 6.8.0-1057.58~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-intel-iotg | 5.15.0-1104.110 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-kvm | 5.15.0-1101.106 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-lowlatency-hwe-6.8 | 6.8.0-134.134.1~22.04.1 | USN-8497-1 |
| Ubuntu 22.04 LTS | linux-nvidia | 5.15.0-1104.105 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-nvidia-6.8 | 6.8.0-1055.58~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra | 5.15.0-1061.61 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-nvidia-tegra-igx | 5.15.0-1050.50 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-oracle | 5.15.0-1106.112 | USN-8388-1 |
| Ubuntu 22.04 LTS | linux-oracle-6.8 | 6.8.0-1054.55~22.04.1 | USN-8373-1 |
| Ubuntu 22.04 LTS | linux-riscv +32 | No fix yet | — |
| Ubuntu 22.04 LTS | linux-xilinx-zynqmp | 5.15.0-1074.78 | USN-8528-1 |
| Ubuntu 20.04 LTS | linux-gke +28 | No fix yet | — |
| Ubuntu 18.04 LTS | linux-gcp +14 | No fix yet | — |
| Ubuntu 16.04 LTS | linux-hwe-edge | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-raspi-realtime | 6.8.0-2046.47 | USN-8373-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime | 6.8.1-1052.53 | USN-8373-1 |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.14 | No fix yet | — |
| Ubuntu Pro Realtime 24.04 LTS | linux-realtime-6.17 | 6.17.0-1014.16~24.04.1 | USN-8371-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-intel-iot-realtime | 5.15.0-1101.103 | USN-8388-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime | 5.15.0-1108.117 | USN-8388-1 |
| Ubuntu Pro Realtime 22.04 LTS | linux-realtime-6.8 | 6.8.1-1052.53~22.04.1 | USN-8373-1 |
| Ubuntu Pro FIPS 20.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS 18.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-aws-fips | 6.8.0-1057.60+fips1 | USN-8373-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-azure-fips | 6.8.0-1059.65+fips1 | USN-8393-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-fips | 6.8.0-124.124+fips1 | USN-8373-1 |
| Ubuntu Pro FIPS-updates 24.04 LTS | linux-gcp-fips | 6.8.0-1060.63+fips1 | USN-8373-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-aws-fips | 5.15.0-1109.116+fips1 | USN-8388-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-azure-fips | 5.15.0-1114.123+fips1 | USN-8426-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-fips | 5.15.0-181.191+fips1 | USN-8388-1 |
| Ubuntu Pro FIPS-updates 22.04 LTS | linux-gcp-fips | 5.15.0-1109.118+fips1 | USN-8388-1 |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-aws-fips | 5.4.0-1160.170+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-azure-fips | 5.4.0-1164.170+fips1 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-fips | 5.4.0-1134.144 | — |
| Ubuntu Pro FIPS-updates 20.04 LTS | linux-gcp-fips | 5.4.0-1163.172+fips1 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-aws-fips | 4.15.0-2132.138 | USN-8530-1 |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-azure-fips | 4.15.0-2111.117 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-fips | 4.15.0-1148.160 | — |
| Ubuntu Pro FIPS-updates 18.04 LTS | linux-gcp-fips | 4.15.0-2094.100 | — |
| Ubuntu Pro FIPS-preview 22.04 LTS | linux-fips +3 | No fix yet | — |
| Ubuntu Pro 20.04 LTS | linux | 5.4.0-231.251 | — |
| Ubuntu Pro 20.04 LTS | linux-aws | 5.4.0-1160.170 | — |
| Ubuntu Pro 20.04 LTS | linux-aws-5.15 | 5.15.0-1109.116~20.04.1 | USN-8388-1 |
| Ubuntu Pro 20.04 LTS | linux-azure | 5.4.0-1164.170 | — |
| Ubuntu Pro 20.04 LTS | linux-azure-5.15 | 5.15.0-1114.123~20.04.1 | USN-8426-1 |
| Ubuntu Pro 20.04 LTS | linux-bluefield | 5.4.0-1119.126 | — |
| Ubuntu Pro 20.04 LTS | linux-gcp | 5.4.0-1163.172 | — |
| Ubuntu Pro 20.04 LTS | linux-gcp-5.15 | 5.15.0-1109.118~20.04.1 | USN-8388-1 |
| Ubuntu Pro 20.04 LTS | linux-hwe-5.15 +1 | 5.15.0-181.191~20.04.1 | USN-8388-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm | 5.4.0-1107.112 | USN-8616-1 |
| Ubuntu Pro 20.04 LTS | linux-ibm-5.15 | 5.15.0-1103.106~20.04.1 | USN-8388-1 |
| Ubuntu Pro 20.04 LTS | linux-intel-iotg-5.15 | 5.15.0-1104.110~20.04.1 | — |
| Ubuntu Pro 20.04 LTS | linux-iot | 5.4.0-1064.67 | — |
| Ubuntu Pro 20.04 LTS | linux-kvm | 5.4.0-1147.156 | — |
| Ubuntu Pro 20.04 LTS | linux-nvidia-tegra-5.15 | 5.15.0-1061.61~20.04.1 | USN-8388-1 |
| Ubuntu Pro 20.04 LTS | linux-oracle | 5.4.0-1158.168 | — |
| Ubuntu Pro 20.04 LTS | linux-oracle-5.15 | 5.15.0-1106.112~20.04.1 | USN-8462-1 |
| Ubuntu Pro 20.04 LTS | linux-raspi | 5.4.0-1143.156 | USN-8391-1 |
| Ubuntu Pro 20.04 LTS | linux-riscv-5.15 | 5.15.0-1103.107~20.04.1 | — |
| Ubuntu Pro 20.04 LTS | linux-xilinx-zynqmp | 5.4.0-1078.82 | — |
| Ubuntu Pro 18.04 LTS | linux | 4.15.0-251.263 | — |
| Ubuntu Pro 18.04 LTS | linux-aws | 4.15.0-1194.207 | USN-8530-1 |
| Ubuntu Pro 18.04 LTS | linux-aws-5.4 | 5.4.0-1160.170~18.04.1 | USN-8392-1 |
| Ubuntu Pro 18.04 LTS | linux-azure-4.15 | 4.15.0-1202.217 | — |
| Ubuntu Pro 18.04 LTS | linux-azure-5.4 | 5.4.0-1164.170~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-gcp-4.15 | 4.15.0-1186.203 | — |
| Ubuntu Pro 18.04 LTS | linux-gcp-5.4 | 5.4.0-1163.172~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-hwe-5.4 | 5.4.0-231.251~18.04.1 | USN-8392-1 |
| Ubuntu Pro 18.04 LTS | linux-ibm-5.4 | 5.4.0-1107.112~18.04.1 | USN-8616-1 |
| Ubuntu Pro 18.04 LTS | linux-kvm | 4.15.0-1175.180 | — |
| Ubuntu Pro 18.04 LTS | linux-oracle | 4.15.0-1155.166 | — |
| Ubuntu Pro 18.04 LTS | linux-oracle-5.4 | 5.4.0-1158.168~18.04.1 | — |
| Ubuntu Pro 18.04 LTS | linux-raspi-5.4 | 5.4.0-1143.156~18.04.1 | USN-8391-1 |
| Ubuntu Pro 16.04 LTS | linux-aws-hwe | 4.15.0-1194.207~16.04.1 | USN-8530-2 |
| Ubuntu Pro 14.04 LTS | linux-azure | 4.15.0-1202.217~14.04.1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10 | rv +76 | 6.12.0-124.56.1.el10_1 | RHSA-2026:19569, RHSA-2026:19074, RHSA-2026:16062 |
| RHEL 9 | rv +75 | 5.14.0-611.55.1.el9_7 | RHSA-2026:19568, RHSA-2026:19225, RHSA-2026:16206 |
| RHEL 8 | kernel-rt +12 | 4.18.0-553.124.1.rt7.465.el8_10 | RHSA-2026:16196 |
| RHEL 8 | kpatch-patch-4_18_0-553_109_1 | 1-2.el8_10 | RHSA-2026:19574 |
| RHEL 8 | kpatch-patch-4_18_0-553_40_1 | 1-11.el8_10 | RHSA-2026:19574 |
| RHEL 8 | kpatch-patch-4_18_0-553_53_1 | 1-9.el8_10 | RHSA-2026:19574 |
| RHEL 8 | kpatch-patch-4_18_0-553_72_1 | 1-6.el8_10 | RHSA-2026:19574 |
| RHEL 8 | kpatch-patch-4_18_0-553_85_1 | 1-4.el8_10 | RHSA-2026:19574 |
| RHEL 8 | perf +26 | 4.18.0-553.124.1.el8_10 | RHSA-2026:16195 |
Show 13 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 10.0 EUS | rv +77 | 6.12.0-55.73.1.el10_0 | RHSA-2026:16314 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_17_1 | 1-14.el9_6 | RHSA-2026:18025 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_39_1 | 1-5.el9_6 | RHSA-2026:18025 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_66_1 | 1-4.el9_6 | RHSA-2026:18025 |
| RHEL 9.6 EUS | kpatch-patch-5_14_0-570_94_1 | 1-2.el9_6 | RHSA-2026:18025 |
| RHEL 9.6 EUS | rv +77 | 5.14.0-570.113.1.el9_6 | RHSA-2026:16312 |
| RHEL 9.4 EUS | bpftool | 7.3.0-427.125.1.el9_4 | RHSA-2026:16100 |
| RHEL 9.4 EUS | kpatch-patch-5_14_0-427_100_1 | 1-4.el9_4 | RHSA-2026:19577 |
| RHEL 9.4 EUS | kpatch-patch-5_14_0-427_113_1 | 1-2.el9_4 | RHSA-2026:19577 |
| RHEL 9.4 EUS | kpatch-patch-5_14_0-427_55_1 | 1-14.el9_4 | RHSA-2026:19577 |
| RHEL 9.4 EUS | kpatch-patch-5_14_0-427_68_2 | 1-11.el9_4 | RHSA-2026:19577 |
| RHEL 9.4 EUS | kpatch-patch-5_14_0-427_84_1 | 1-6.el9_4 | RHSA-2026:19577 |
| RHEL 9.4 EUS | rv +64 | 5.14.0-427.125.1.el9_4 | RHSA-2026:16100 |
| RHEL 9.2 E4S | bpftool | 7.0.0-284.170.1.el9_2 | RHSA-2026:16328 |
| RHEL 9.2 E4S | kernel-rt +14 | 5.14.0-284.170.1.rt14.455.el9_2 | RHSA-2026:16254 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_104_1 | 1-15.el9_2 | RHSA-2026:19573 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_117_1 | 1-12.el9_2 | RHSA-2026:19573 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_134_1 | 1-6.el9_2 | RHSA-2026:19573 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_148_1 | 1-4.el9_2 | RHSA-2026:19573 |
| RHEL 9.2 E4S | kpatch-patch-5_14_0-284_158_1 | 1-2.el9_2 | RHSA-2026:19573 |
| RHEL 9.2 E4S | perf +47 | 5.14.0-284.170.1.el9_2 | RHSA-2026:16328 |
| RHEL 9.0 E4S | kernel-rt +12 | 5.14.0-70.179.1.rt21.251.el9_0 | RHSA-2026:16203 |
| RHEL 9.0 E4S | kpatch-patch-5_14_0-70_124_1 | 1-13.el9_0 | RHSA-2026:19575 |
| RHEL 9.0 E4S | kpatch-patch-5_14_0-70_132_1 | 1-9.el9_0 | RHSA-2026:19575 |
| RHEL 9.0 E4S | kpatch-patch-5_14_0-70_144_1 | 1-5.el9_0 | RHSA-2026:19575 |
| RHEL 9.0 E4S | kpatch-patch-5_14_0-70_155_1 | 1-4.el9_0 | RHSA-2026:19575 |
| RHEL 9.0 E4S | kpatch-patch-5_14_0-70_167_1 | 1-2.el9_0 | RHSA-2026:19575 |
| RHEL 9.0 E4S | perf +28 | 5.14.0-70.179.1.el9_0 | RHSA-2026:16202 |
| RHEL 8.8 TUS | perf +17 | 4.18.0-477.140.1.el8_8 | RHSA-2026:16061 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_107_1 | 1-5.el8_8 | RHSA-2026:19572 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_120_1 | 1-4.el8_8 | RHSA-2026:19572 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_130_1 | 1-2.el8_8 | RHSA-2026:19572 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_89_1 | 1-11.el8_8 | RHSA-2026:19572 |
| RHEL 8.8 E4S | kpatch-patch-4_18_0-477_97_1 | 1-9.el8_8 | RHSA-2026:19572 |
| RHEL 8.8 E4S | perf +18 | 4.18.0-477.140.1.el8_8 | RHSA-2026:16061 |
| RHEL 8.6 TUS | perf +17 | 4.18.0-372.192.1.el8_6 | RHSA-2026:16204 |
| RHEL 8.6 E4S | kpatch-patch-4_18_0-372_137_1 | 1-11.el8_6 | RHSA-2026:19564 |
| RHEL 8.6 E4S | kpatch-patch-4_18_0-372_145_1 | 1-9.el8_6 | RHSA-2026:19564 |
| RHEL 8.6 E4S | kpatch-patch-4_18_0-372_158_1 | 1-5.el8_6 | RHSA-2026:19564 |
| RHEL 8.6 E4S | kpatch-patch-4_18_0-372_170_1 | 1-4.el8_6 | RHSA-2026:19564 |
| RHEL 8.6 E4S | kpatch-patch-4_18_0-372_181_1 | 1-2.el8_6 | RHSA-2026:19564 |
| RHEL 8.6 E4S | perf +25 | 4.18.0-372.192.1.el8_6 | RHSA-2026:16204 |
| RHEL 8.6 AUS | perf +17 | 4.18.0-372.192.1.el8_6 | RHSA-2026:16204 |
| RHEL 8.4 EUS Long Life | perf +17 | 4.18.0-305.191.1.el8_4 | RHSA-2026:16201 |
| RHEL 8.4 AUS | perf +17 | 4.18.0-305.191.1.el8_4 | RHSA-2026:16201 |
| Red Hat Enterprise Linux Nvidia 10 | rv +35 | 6.12.0-211.7.el10nv | RHSA-2026:33486, RHSA-2026:17795 |
AlmaLinux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| AlmaLinux 10 | rv +103 | 6.12.0-124.55.3.el10_1 | ALSA-2026:A006, ALSA-2026:19569, ALSA-2026:19074 |
| AlmaLinux 9 | rv +116 | 5.14.0-611.54.3.el9_7 | ALSA-2026:A005, ALSA-2026:19568, ALSA-2026:19225 |
| AlmaLinux 8 | kernel-rt +14 | 4.18.0-553.123.2.rt7.464.el8_10 | ALSA-2026:A007, ALSA-2026:16196 |
| AlmaLinux 8 | perf +29 | 4.18.0-553.123.2.el8_10 | ALSA-2026:A004, ALSA-2026:16195 |
Rocky Linux
Errata ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Rocky Linux 10 | kernel | 6.12.0-124.56.1.el10_1 | RLSA-2026:19569, RLSA-2026:16062 |
| Rocky Linux 9 | kernel | 5.14.0-611.55.1.el9_7 | RLSA-2026:19568, RLSA-2026:16206 |
| Rocky Linux 8 | kernel | 4.18.0-553.124.1.el8_10 | RLSA-2026:16195 |
| Rocky Linux 8 | kernel-rt | 4.18.0-553.124.1.rt7.465.el8_10 | RLSA-2026:16196 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | kernel-64kb +6 | 6.4.0-150700.53.60.1 | SUSE-SU-2026:2800-1, SUSE-SU-2026:2482-1 |
| SLES 15 SP7 | kernel-default-base | 6.4.0-150700.53.60.1.150700.17.35.4 | SUSE-SU-2026:2800-1, SUSE-SU-2026:2482-1 |
| SLES 15 SP7 | kernel-obs-build | 6.4.0-150700.53.60.2 | SUSE-SU-2026:2800-1, SUSE-SU-2026:2482-1 |
| SLES 15 SP6 | kernel-64kb +6 | 6.4.0-150600.23.115.1 | SUSE-SU-2026:2310-1 |
| SLES 15 SP6 | kernel-default-base | 6.4.0-150600.23.115.1.150600.12.54.1 | SUSE-SU-2026:2310-1 |
| SLES 12 SP5 | kernel-syms +2 | 4.12.14-122.320.1 | SUSE-SU-2026:2914-1 |
Show 10 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1 |
| SLES for SAP 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLES for SAP 15 SP6 | kernel-default-base | 6.4.0-150600.23.115.1.150600.12.54.1 | SUSE-SU-2026:2310-1 |
| SLES for SAP 15 SP6 | kernel-docs +4 | 6.4.0-150600.23.115.1 | SUSE-SU-2026:2310-1 |
| SLES 16.0 | kernel-64kb +8 | 6.12.0-160000.36.1 | SUSE-SU-2026:22835-1, SUSE-SU-2026:22812-1 |
| SLES 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22835-1 |
| SLE Micro 6.2 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-rt +3 | 6.12.0-160000.36.1 | SUSE-SU-2026:22769-1 |
| SLE Micro 6.2 | kernel-syms +1 | 6.12.0-160000.30.1 | SUSE-SU-2026:22742-1, SUSE-SU-2026:21594-1 |
| SLE Micro 6.1 | kernel-default-base | 6.4.0-47.1.21.24 | SUSE-SU-2026:22137-1 |
| SLE Micro 6.1 | kernel-rt +1 | 6.4.0-48.1 | SUSE-SU-2026:22458-1 |
| SLE Micro 6.1 | kernel-source +2 | 6.4.0-47.1 | SUSE-SU-2026:22137-1 |
| SLE Micro 6.0 | kernel-default-base | 6.4.0-47.1.21.24 | SUSE-SU-2026:22108-1 |
| SLE Micro 6.0 | kernel-rt +1 | 6.4.0-48.1 | SUSE-SU-2026:22433-1 |
| SLE Micro 6.0 | kernel-source +2 | 6.4.0-47.1 | SUSE-SU-2026:22108-1 |
| SLE Live Patching 15 SP7 | kernel-default | 6.4.0-150700.53.60.1 | SUSE-SU-2026:2800-1, SUSE-SU-2026:2482-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_16 | 1-150700.1.5.2 | SUSE-SU-2026:2591-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7-RT_Update_17 | 1-150700.1.3.1 | SUSE-SU-2026:2799-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_16 | 1-150700.15.3.2 | SUSE-SU-2026:2482-1 |
| SLE Live Patching 15 SP7 | kernel-livepatch-SLE15-SP7_Update_18 | 1-150700.15.3.1 | SUSE-SU-2026:2800-1 |
| SLE Live Patching 15 SP6 | kernel-default | 6.4.0-150600.23.115.1 | SUSE-SU-2026:2310-1 |
| SLE Live Patching 15 SP6 | kernel-livepatch-SLE15-SP6_Update_27 | 1-150600.13.3.1 | SUSE-SU-2026:2310-1 |
| SLE Live Patching 12 SP5 | kernel-default | 4.12.14-122.320.1 | SUSE-SU-2026:2914-1 |
| SLE Live Patching 12 SP5 | kgraft-patch-SLE12-SP5_Update_85 | 1-8.3.1 | SUSE-SU-2026:2914-1 |
| SUSE Real Time Module 15 SP7 | kernel-rt +1 | 6.4.0-150700.7.59.2 | SUSE-SU-2026:2799-1, SUSE-SU-2026:2591-1 |
| SUSE Real Time Module 15 SP7 | kernel-syms-rt | 6.4.0-150700.7.59.1 | SUSE-SU-2026:2799-1, SUSE-SU-2026:2591-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 7.0.7-1.1 | openSUSE-SU-2026:10793-1 |
| openSUSE Leap 16.0 | kernel-default-base | 6.12.0-160000.36.1.160000.2.17 | openSUSE-SU-2026:21388-1 |
| openSUSE Leap 16.0 | kernel-rt +11 | 6.12.0-160000.36.1 | openSUSE-SU-2026:21388-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2023 | kernel-livepatch-6.18.25-55.108 +2 | 1:1.0-0.amzn2023 | ALAS2023-2026-1695, ALAS2023-2026-1694, ALAS2023-2026-1693 |
| Amazon Linux 2023 | perf +11 | 1:6.1.170-210.320.amzn2023 | ALAS2023-2026-1694 |
| Amazon Linux 2023 | perf6.12 +11 | 1:6.12.83-113.160.amzn2023 | ALAS2023-2026-1695 |
| Amazon Linux 2023 | perf6.18 +11 | 1:6.18.25-55.108.amzn2023 | ALAS2023-2026-1693 |
| Amazon Linux 2 | kernel-livepatch-4.14.355-282.728 | 1.0-0.amzn2 | ALAS2-2026-3302 |
| Amazon Linux 2 | perf +8 | 4.14.355-282.728.amzn2 | ALAS2-2026-3302 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kernel | 6.6.138.1-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 10 | rv +29 | 6.12.0-124.56.1.el10_1 | ELSA-2026-19569, ELSA-2026-19074, ELSA-2026-16062 |
| Oracle Linux 9 | kernel-uek +34 | 6.12.0-201.74.2.3.el10uek | ELSA-2026-50372, ELSA-2026-50293, ELSA-2026-50260 |
| Oracle Linux 9 | rv +28 | 5.14.0-611.55.1.el9_7 | ELSA-2026-19568, ELSA-2026-19225, ELSA-2026-16206 |
| Oracle Linux 8 | kernel-uek +17 | 5.15.0-318.199.3.6.el9uek | ELSA-2026-50294, ELSA-2026-50275, ELSA-2026-50261 |
| Oracle Linux 8 | perf +19 | 4.18.0-553.124.1.el8_10 | ELSA-2026-50294, ELSA-2026-50275, ELSA-2026-50261 |
| Oracle Linux 7 | kernel-uek +6 | 5.4.17-2136.354.4.3.el8uek | ELSA-2026-50299, ELSA-2026-50262, ELSA-2026-50258 |
| Oracle Linux 7 | kernel-uek-tools | 5.4.17-2136.354.4.3.el7uek | ELSA-2026-50299, ELSA-2026-50262, ELSA-2026-50258 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
xfrm-ESP Page-Cache Write via CVE-2026-43284
exploit/linux/local/cve_2026_43284_dirty_frag
Exploit-DB 2
- Linux Kernel - Local Privilege Escalation EDB-52591 · local · May 29, 2026
- Linux Kernel - Local Privilege Escalation EDB-52585 · local · May 27, 2026
GitHub 48 repositories · most starred shown
-
ankitrawatgit/DirtyFrag-Android-Root-Jailbreak ★ 67 · Oct 2, 2026
DirtyFrag Android Root is an Android app and helper module chain based on DirtyFrag (CVE-2026-43284). Tested on iQOO Z9 5G.
-
linnemanlabs/dirtyfrag-arm64 ★ 40 · May 10, 2026
arm64/aarch64 port of V4bel/dirtyfrag (CVE-2026-43284). ESP-only - rxrpc path kernel-oopses on arm64 due to flush_dcache_page
-
ashrafzaryouh/CVE-2026-43284 ★ 27 · May 8, 2026
CVE-2026-43284
-
Percivalll/Dirty-Frag-Kubernetes-PoC ★ 18 · May 8, 2026
A proof-of-concept demonstrating how a default, unprivileged Kubernetes Pod can achieve node-level code execution on Amazon EKS by exploiting the Dirty Frag (CVE-2026-43284) Linux kernel page-cache c…
-
liamromanis101/DirtyFrag-Detector ★ 16 · May 11, 2026
CVE-2026-43284/CVE-2026-43500 'DirtyFrag' Benign patch & mitigation detection script
-
a2333c/DFRoot ★ 10 · Sep 27, 2026
三星 Galaxy S25 Ultra（SM-S938B）适配版 DFRoot：开机自动获取 root（DirtyFrag CVE-2026-43284 + CVE-2026-43499 双链路），全中文界面，fork 自 diabl0w/DFRoot
-
RemiPelloux/GalaxyCrash ★ 5 · Oct 19, 2026
Ephemeral root for Samsung Galaxy devices via CVE-2026-43284 — stability fork of DirtyFrag. Reboot to undo.
-
haydenjames/dirty-frag-check ★ 5 · May 9, 2026
Read-only checker for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) Linux kernel local-root vulns
-
mcxiaochenn/iqooNeo8-V2301A-DirtyFrag ★ 3 · Nov 4, 2026
iQOO Neo8 (PD2301/V2301A) 一键越狱 — DirtyFrag (CVE-2026-43284) port on the pyb110 UI
-
mym0us3r/DIRTY-FRAG-Detection-with-Wazuh-4.14.4 ★ 3 · May 8, 2026
Wazuh 4.14.4 detection rules for CVE-2026-43284 / CVE-2026-43500 (Dirty Frag) - Linux Local Privilege Escalation via page cache write
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 50
- RHSA-2026:19568 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- RHSA-2026:19569 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Nov 13, 2026
- WID-SEC-2026-1430 Linux Kernel (Dirty Frag): Mehrere Schwachstellen ermöglichen Erlangen von Administratorrechten BSI CERT-Bund (WID) · Nov 10, 2026
- WID-SEC-2026-4288 Android Patchday November 2026 (Google Android, Automotive OS and XR): Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 10, 2026
- USN-8569-1 linux-hwe-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8373-1 linux, linux-aws, linux-aws-6.8, linux-aws-fips, linux-azure, linux-fips, linux-gcp, linux-gcp-6.8, linux-gcp-fips, linux-gke, linux-gkeop, linux-hwe-6.8, linux-ibm, linux-ibm-6.8, linux-nvidia, linux-nvidia-6.8, linux-nvidia-lowlatency, linux-nvidia-tegra, linux-oracle, linux-oracle-6.8, linux-raspi, linux-raspi-realtime, linux-realtime, linux-realtime-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8489-1 linux-oem-7.0 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8440-1 linux-azure-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8461-1 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8371-1 linux, linux-aws, linux-azure, linux-azure-6.17, linux-hwe-6.17, linux-nvidia-6.17, linux-oem-6.17, linux-oracle, linux-oracle-6.17, linux-raspi, linux-realtime, linux-realtime-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8370-1 linux, linux-aws, linux-gcp, linux-ibm, linux-nvidia, linux-oracle, linux-raspi, linux-realtime vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8374-1 linux-aws-6.17, linux-gcp, linux-gcp-6.17 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8497-1 linux-lowlatency, linux-lowlatency-hwe-6.8 vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8499-1 linux-xilinx vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8393-1 linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 7, 2026
- USN-8392-1 linux-aws-5.4, linux-hwe-5.4 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8528-1 linux-xilinx-zynqmp vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8462-1 linux-oracle-5.15 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8426-2 linux-azure vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8391-1 linux-raspi, linux-raspi-5.4 vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- USN-8426-1 linux-azure-5.15, linux-azure-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 6, 2026
- NCSC-2026-0467 Kwetsbaarheden verholpen in Google Android en Samsung Mobile NCSC-NL (Netherlands) · Nov 5, 2026
- USN-8616-1 linux-ibm, linux-ibm-5.4 vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8530-1 linux-aws, linux-aws-fips vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- USN-8530-2 linux-aws-hwe vulnerabilities Ubuntu Security Notices (USN) · Nov 4, 2026
- ALSA-2026:19569 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19568 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A005 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:16206 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19225 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A006 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:19074 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A007 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:16195 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:16196 Important: kernel-rt security update AlmaLinux Security Advisories · Oct 29, 2026
- ALSA-2026:A004 Important: kernel security update AlmaLinux Security Advisories · Oct 29, 2026
- ICSA-26-302-03 Hitachi Energy CoreTec Product CISA ICS & IT advisories · Oct 29, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- WID-SEC-2026-3623 IBM DataPower Gateway: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 18, 2026
- NCSC-2026-0431 Kwetsbaarheden verholpen in IBM DataPower Gateway en onderliggende componenten NCSC-NL (Netherlands) · Oct 16, 2026
- SSA-019113 SSA-019113: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.6 Siemens ProductCERT · Oct 13, 2026
- SSA-082556 SSA-082556: Vulnerabilities in the additional GNU/Linux subsystem of the SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP V3.1.5 Siemens ProductCERT · Oct 13, 2026
- RHSA-2026:33486 Red Hat Security Advisory: kernel security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Oct 10, 2026
- RHSA-2026:19577 Red Hat Security Advisory: kpatch-patch-5_14_0-427_100_1, kpatch-patch-5_14_0-427_113_1, kpatch-patch-5_14_0-427_55_1, kpatch-patch-5_14_0-427_68_2, and kpatch-patch-5_14_0-427_84_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19575 Red Hat Security Advisory: kpatch-patch-5_14_0-70_124_1, kpatch-patch-5_14_0-70_132_1, kpatch-patch-5_14_0-70_144_1, kpatch-patch-5_14_0-70_155_1, and kpatch-patch-5_14_0-70_167_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19573 Red Hat Security Advisory: kpatch-patch-5_14_0-284_104_1, kpatch-patch-5_14_0-284_117_1, kpatch-patch-5_14_0-284_134_1, kpatch-patch-5_14_0-284_148_1, and kpatch-patch-5_14_0-284_158_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19574 Red Hat Security Advisory: kpatch-patch-4_18_0-553_109_1, kpatch-patch-4_18_0-553_40_1, kpatch-patch-4_18_0-553_53_1, kpatch-patch-4_18_0-553_72_1, and kpatch-patch-4_18_0-553_85_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19572 Red Hat Security Advisory: kpatch-patch-4_18_0-477_107_1, kpatch-patch-4_18_0-477_120_1, kpatch-patch-4_18_0-477_130_1, kpatch-patch-4_18_0-477_89_1, and kpatch-patch-4_18_0-477_97_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19564 Red Hat Security Advisory: kpatch-patch-4_18_0-372_137_1, kpatch-patch-4_18_0-372_145_1, kpatch-patch-4_18_0-372_158_1, kpatch-patch-4_18_0-372_170_1, and kpatch-patch-4_18_0-372_181_1 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- RHSA-2026:19225 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
References
- https://git.kernel.org/stable/c/a6cb440f274a22456ef3e86b457344f1678f38f9
- https://git.kernel.org/stable/c/ab8b995323e5237041472d07e5055f5f7dcdf15b
- https://git.kernel.org/stable/c/fe785bb3a8096dffcc4048a85cd0c83337eeecad
- https://git.kernel.org/stable/c/5d55c7336f8032d434adcc5fab987ccc93a44aec
- https://git.kernel.org/stable/c/8253aab4659ca16116b522203c2a6b18dccacea7
- https://git.kernel.org/stable/c/50ed1e7873100f77abad20fd31c51029bc49cd03
- https://git.kernel.org/stable/c/b54edf1e9a3fd3491bdcb82a21f8d21315271e0d
- https://git.kernel.org/stable/c/71a1d9d985d26716f74d21f18ee8cac821b06e97
- https://git.kernel.org/stable/c/52646cbd00e765a6db9c3afe9535f26218276034
- https://git.kernel.org/stable/c/f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4