CVE-2026-43284 is a Linux kernel local privilege escalation vulnerability in shared socket buffer fragment handling. Red Hat calls the issue Important and assigns a CVSS 3.1 score of 7.8 High.A low-privileged local attacker may corrupt page-cache contents of readable files. Red Hat says this can include sensitive system files and can result in root privileges.
What it allows
How Does CVE-2026-43284 Affect the Linux Kernel?
The flaw involves unsafe in-place cryptographic processing of shared socket buffer fragments. The Linux record explains that UDP splice paths did not mark shared fragments as TCP already did.
An ESP-in-UDP packet could therefore appear privately owned when its data remained externally backed. ESP input could then decrypt that data in place instead of first creating a private copy.
Red Hat says the xfrm-ESP path requires unprivileged user or network namespace creation. Its description also identifies an RxRPC path that depends on the rxrpc module being available.
Who is affected
NVD lists affected Linux kernel ranges starting at 4.11, 5.12, 5.16, 6.2, 6.7, 6.13, and 7.0. The corresponding fixed boundaries are 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28, and 7.0.5.
Distribution kernels may carry backported fixes without matching an upstream version number. Administrators should use their Linux vendor's advisory and package status to confirm remediation.
What to do
-
Install the corrected kernel from your Linux vendor
Apply the vendor-supported kernel update and reboot into the corrected kernel. Confirm the running kernel and package status after the maintenance window.
-
Prioritize hosts with local untrusted users
Prioritize shared systems, developer hosts, and other machines where low-privileged users can run local code. Review whether unprivileged user or network namespaces are available.
-
Check the RxRPC exposure condition
Brandefense recommends identifying hosts where the rxrpc module is available. Include those systems in the first remediation group alongside namespace-enabled hosts.
-
Investigate unexpected privileged changes
Brandefense recommends reviewing authentication, privilege, and file-integrity records for unexplained root activity or changes to sensitive system files. Preserve relevant evidence before rebuilding a suspected host.
What Brandefense can do
- Scan your domain in Brandefense Atlas, free
Atlas checks public sources for leaked credentials, phishing domains, dark web mentions and data sales, then gives your domain a risk grade. Free, no sign-up.
- Vulnerability Intelligence
Brandefense Vulnerability Intelligence follows which vulnerabilities attackers are using, so your team can patch what is under attack first.
Frequently Asked Questions
What is CVE-2026-43284?
It is a Linux kernel flaw in shared fragment handling. A low-privileged local attacker may corrupt readable file data and gain root privileges.
Which Linux kernel versions are affected by CVE-2026-43284?
NVD lists affected ranges across several maintained branches. Fixed boundaries include 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28, and 7.0.5.
Does CVE-2026-43284 require remote access?
Red Hat describes a local attack requiring low privileges. The xfrm-ESP variant also requires unprivileged user or network namespace creation.
How should administrators fix CVE-2026-43284?
Install the corrected kernel supplied by the Linux distribution, reboot the host, and verify that the corrected kernel is running.
Sources
- Red Hat: CVE-2026-43284Red Hat
- NVD: CVE-2026-43284NIST NVD
