This repository contains a proof-of-concept exploit for two Linux kernel vulnerabilities (CVE-2026-43284 and CVE-2026-43500), collectively called 'Dirty Frag'. The exploit chains an xfrm-ESP page-cache write vulnerability (requires user namespace creation) with an RxRPC page-cache write vulnerability (does not require namespace creation) to achieve root privilege escalation on major Linux distributions. The single C source file (exp.c) implements both exploit paths and a fallback chain: it first attempts to overwrite /usr/bin/su with a minimal root-shell ELF using the ESP variant, and if that fails (e.g., due to AppArmor blocking user namespaces), it falls back to patching /etc/passwd's root entry to have an empty password field via the RxRPC variant, then spawns a root shell via su. The code demonstrates advanced kernel exploitation techniques including splice-based page cache injection, in-place crypto manipulation, and user-space porting of kernel crypto primitives (fcrypt). It is not a reusable library or framework but a targeted exploit PoC.

The LLM identified 1 files worth highlighting for reuse: