---
title: DirtyFrag vulnerability - CVE-2026-43284 / CVE-2026-43500
url: https://www.broadcom.com/support/security-center/protection-bulletin/dirtyfrag-vulnerability-cve-2026-43284-cve-2026-43500
description: Dirty Frag (CVE-2026-43284/43500) chains two Linux kernel bugs to allow local attackers to obtain root privileges.
---

# DirtyFrag vulnerability - CVE-2026-43284 / CVE-2026-43500

May 08, 2026

Just a week after the disclosure of the CopyFail (CVE-2026-31431) vulnerability, a second Linux kernel critical flaw has been discovered with public technical details and proof-of-concept code released publicly. Dubbed Dirty Frag, the vulnerability chains two distinct kernel bugs: CVE-2026-43284 (ESP subsystem) and CVE-2026-43500 (RxRPC subsystem). Both vulnerabilities allow modification of page-cache-backed memory that is not exclusively owned by the kernel. If successfully exploited the flaw allows attackers with local access to obtain root privileges on most major Linux distributions.

Symantec protects you from this threat, identified by the following:

**File-based**
- Exp.CVE-2026-43284

**Policy-Based**

Symantec Data Center Security (DCS) provides out-of-the-box protection against the Dirty Frag: Universal Linux LPE vulnerability through its default Unix OS Prevention policies. DCS protection mechanism:
- Blocking the Exploit Vector: The Dirty Frag exploit typically relies on gaining write access to /proc/sys/. By default, DCS Unix Prevention policies do not allow write access to these logical files, as such behavior is deemed unusual and undesirable.
- Broad Coverage: This protection has been a core component of the DCS Unix Policy since 2005, meaning all versions of DCS offer this level of protection by default.
- Zero-Day Efficacy: Because DCS focuses on application and OS behavior rather than signatures, it provides protection without requiring a specific patch for the vulnerability.
- User Constraints: The policy denies the exploit attempt for all interactive non-privileged user accounts, as well as the root user.
- Detection Capabilities: Customers using only Detection Policies can use DCS to identify if a Dirty Frag exploit is being executed by deploying a targeted prevention policy in monitor-only mode with the same read-only file rule for /proc/sys/*.