Vulnerability in Linux
CVE-2026-43284
In the Linux kernel, the following vulnerability has been resolved: xfrm: esp: avoid in-place decrypt on shared skb frags MSG_SPLICE_PAGES can attach pages from a pipe directly to an skb. TCP marks such skbs with SKBFL_SHARED_FRAG after…
EPSS: 0.385 (97.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 8.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Linux — versions 6.12.87, 6.6.138, 5.15.205
- Linux Linux_kernel
Weakness classification (CWE)
Public proof-of-concept exploits
- linnemanlabs/dirtyfrag-arm64
- liamromanis101/DirtyFrag-Detector
- Percivalll/Dirty-Frag-Kubernetes-PoC
- 0xBlackash/CVE-2026-43284
- haydenjames/dirty-frag-check
- jayhutajulu1/CVE-2026-43284-DirtyFrag-PoC
- mym0us3r/DIRTY-FRAG-Detection-with-Wazuh-4.14.4
- AK777177/Dirty-Frag-Analysis
- kuniyal08/Dirty-Frag-CVE-2026-43284
- LucasPDiniz/CVE-2026-43284
References
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- af854a3a-2127-422b-91ae-364da2661108 (Mailing List)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Patch)
- 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Exploit, Third Party Advisory)
- 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Frequently asked questions
- What is CVE-2026-43284?
- CVE-2026-43284 is a high-severity vulnerability in Linux, classified under Write-what-where Condition. CVSS score: 8.8/10. Published 2026-05-08.
- How severe is CVE-2026-43284?
- High severity. CVSS v3 base score is 8.8 out of 10.
- Is CVE-2026-43284 known to be exploited?
- 32 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.