How to Patch the Dirty Frag Exploit on Linux: A Step-by-Step Guide

Introduction

The Dirty Frag vulnerability (CVE-2026-43500) recently made headlines in the Linux community. This local privilege escalation (LPE) exploit, accidentally exposed to the public, allowed attackers with user access to tamper with kernel memory during decryption, potentially gaining root privileges. The vulnerability carries a CVSS score of 7.8 (HIGH).

Thankfully, a proper patch has been released in Linux kernel 7.0.6 and the long-term support (LTS) version 6.18.29. Major distributions like Fedora and Pop!_OS have already pushed their own fixes. This guide will walk you through the steps to update your Linux system and protect against Dirty Frag.

Jump to the steps

What You Need

• A Linux system (Fedora, Pop!_OS, or other distribution)
• Root access (sudo privileges)
• Stable internet connection
• A recent backup of your important data – updating the kernel carries a small risk of system instability
• Basic familiarity with the terminal

Step-by-Step Instructions

Step 1: Back Up Your Data

Before making any system-level changes, ensure you have a full backup. Use tools like rsync, dd, or a cloud backup service. If something goes wrong during the kernel update, you can restore your system.

Step 2: Check Your Current Kernel Version

Open a terminal and run: uname -r. This shows the kernel version you are currently running. If it is already 7.0.6 or 6.18.29 LTS (or a distro-specific patched version), you may already be protected. However, verify your distribution’s specific release notes.

Step 3: Update Your Package Repositories

Use your distribution’s package manager to refresh the list of available packages. General command: sudo apt update (Debian/Ubuntu) or sudo dnf check-update (Fedora). This ensures you get the latest kernel patch.

Step 4: For Fedora Users

Fedora kernel maintainer Justin Forbes released the fix in kernel 7.0.4-100.fc43 for Fedora 43 and 44, and 6.19.14-101 for Fedora 42. Follow these steps:

1. Run: sudo dnf update to see available updates. You should notice the patched kernel listed.
2. Then upgrade: sudo dnf upgrade. When prompted, press Y to confirm the installation.
3. Wait for the process to complete. Your system now has the Dirty Frag fix.

Step 5: For Pop!_OS Users

System76 has released kernel updates covering both Dirty Frag CVEs for Pop!_OS 22.04 and 24.04 LTS. They patched the esp4/esp6 modules and disabled the rxrpc module. To update:

1. Run: sudo apt update && sudo apt upgrade
2. After the upgrade finishes, reboot: sudo reboot

Step 6: For Other Linux Distributions

If you are using a distribution that hasn’t pushed an update yet, you can manually install the patched kernel from kernel.org. This is intended for experienced users. For guidance, refer to our tips section. For Ubuntu-based systems, we have a separate guide covering manual installation.

Step 7: Reboot Your System

After updating the kernel, a reboot is required to boot into the new kernel. Use sudo reboot. Make sure no unsaved work is open.

Step 8: Verify the Update

After reboot, run uname -r again. Confirm the kernel version matches the patched version (e.g., 7.0.6 or 6.18.29 LTS). You can also check the changelog: dmesg | grep -i "dirty" to see if the fix is applied.

Tips & Final Notes

• Backup is crucial: Kernel updates are generally safe, but if your system has custom modules or drivers, a rollback might be needed. Have a live USB handy.
• Stay informed: For the full technical details of Dirty Frag, read our earlier coverage (linked below). Understanding the exploit helps you appreciate why this patch is urgent.
• Consider automation: Use unattended-upgrades (Ubuntu) or automatic DNF updates (Fedora) to keep your kernel current in the future.
• If you compiled your own kernel: Apply the patch from Linus Torvalds’ commit (merged May 10) to the affected rxrpc functions. The fix extends checks for splice() and fragment chain packets.
• Need help? For manual installation on Ubuntu, see our dedicated how-to guide. For Fedora or Pop!_OS, the steps above are sufficient.

Stay safe and keep your systems updated!