Sysdig tracks “Dirty Frag” (disclosed May 8, 2026 by Hyunwoo Kim, PoC on GitHub) as twin LPEs in the kernel’s ESP/IPsec receive path (CVE-2026-43284, introduced January 2017) and rxrpc fast path (CVE-2026-43500, added June 2023), both performing in-place decryption without validating memory ownership.
An attacker points a crafted packet at cached pages of /usr/bin/su, decrypts with an attacker-controlled key, and shellcode lands in the shared page cache.
It is a deterministic logic flaw, no races required, against kernels 4.10 through 7.0.
Sysdig Secure shipped two new runtime rules and a Falco recipe watching for unexpected AF_RXRPC socket creation, because at publication time no distro had a patched kernel out and AFS daemons are basically the only legitimate rxrpc users on Earth.
