Dirty Frag (CVE-2026-43284, CVE-2026-43500): Frequently asked questions about this Linux kernel privilege escalation vulnerability chain
2026-05-11T20:52:18Z•eef1fdbd7147a712cf57fc02dfc3c581cf8763b9d6bd55a1295e4b87fa606b43
CVE-2026-43284CVE-2026-43500LPEcopy-faildirty-fragexploit-publickernellinuxlocal-privilege-escalationprivilege-escalation
What happened
Dirty Frag is a chained Linux kernel local privilege escalation (LPE) vulnerability (CVE-2026-43284 and CVE-2026-43500) that can allow a local user to gain root. The chain was publicly disclosed after an embargo was broken (May 7–8, 2026) and proof-of-concept exploit code was released (GitHub: V4bel). The exploit extends the Copy Fail class of kernel bugs. Vendor patches were expected to be released shortly after disclosure.
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- tenable_blog
- Record identifier
- eef1fdbd7147a712cf57fc02dfc3c581cf8763b9d6bd55a1295e4b87fa606b43
- Enrichment time
- 2026-05-11T20:52:18Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.