Preface: The “Dirty Frag” attack chains two separate flaws in the Linux kernel’s networking stack: one in the ESP(Encapsulating Security Payload) protocol used by IPsec and another in the RxRPC protocol used for the AFS distributed file system. If you do not use IPsec, disabling its modules removes one of the major attack paths.
Background: The “Dirty Frag” vulnerability is deemed difficult to patch immediately due to its exploitation of a long-standing core Linux kernel optimization, which initially lacked official, widespread patches upon disclosure. While disabling ESP modules helps, effective mitigation requires blacklisting both ESP and RxRPC modules, or patching the kernel directly.
How to mitigate vulnerabilities:
Step 1:Block the ESP and RxRPC modules: Create a configuration file (e.g., /etc/modprobe.d/dirtyfrag.conf) to ensure the modules cannot be auto-loaded by an exploit:
bash
install esp4 /bin/falseinstall esp6 /bin/falseinstall rxrpc /bin/falseStep 2:Unload current modules: Remove the modules if they are currently active in memory:
bash
sudo modprobe -r esp4 esp6 rxrpc Step 3:Clear the Page Cache: The exploit works by corrupting the page cache. After applying the blocks, clear the cache to ensure no malicious changes persist in RAM:
bash
sudo sync && echo 3 | sudo tee /proc/sys/vm/drop_caches Official announcement: Please refer to the link for details – https://nvd.nist.gov/vuln/detail/CVE-2026-43284