DirtyFrag: Linux kernel privilege escalation via Dirty Page cache

DirtyFrag (CVE-2026-43284) is a Linux kernel privilege-escalation path through xfrm ESP page cache corruption. This entry covers the lab build, detection opportunities, and how I retested the exploitation and cleanup path.

Approach

Recreated the vulnerable kernel behavior in a lab and worked through exploitation end to end, then shifted focus to detection rather than only reproduction.

What it tested

The bug lives in ESP page cache handling on xfrm. Successful exploitation leaves filesystem and memory artifacts that are easier to catch than the initial abuse, so I focused on post-exploit triage and kernel/network telemetry that still survives the attack.

Detection

Detection opportunities fall into two buckets: filesystem/metadata remnants after exploitation, and kernel/xfrm telemetry during abuse. I captured both in the lab and validated them against live memory and audit logs.

Retest

Retest steps are included in the linked repo: build the vulnerable environment, run the exploit, verify artifacts, then validate the detection rules before cleanup.

Full lab notes and detection steps are in the repo linked above.