Linux kernel "Dirty Frag" vulnerability (CVE-2026-43284, CVE-2026-43500)

ServerPilot has applied mitigations to all servers for the Linux kernel vulnerability known as Dirty Frag. This vulnerability in the Linux kernel’s esp4, esp6, and rxrpc modules allows local privilege escalation and affects all Linux distributions, including Ubuntu.

The Linux kernel’s esp4 and esp6 modules provide the Encapsulating Security Payload (ESP) protocol used for IPsec. These modules are rarely used on servers hosting web applications.

The Linux kernel’s rxrpc module provides the RxRPC protocol used for AFS, a distributed file system. This module is rarely used.

Affected Ubuntu releases

The vulnerability affects all Ubuntu releases.

What we have done

ServerPilot has applied the recommended mitigation to all servers by configuring servers to not load the esp4, esp6, and rxrpc modules.

What Ubuntu has done

As of May 8, 2026, Ubuntu has not yet released a patch for the vulnerability.

Ubuntu will likely release a patch for the vulnerability soon.

Servers that have automatic updates enabled (the ServerPilot default) and that are running Ubuntu releases that still receive updates will automatically install the updated package(s) when they are available.

What you should do

Confirm the server still receives updates from Ubuntu

Servers running Ubuntu 20.04 or earlier do not receive updates from Ubuntu unless the server is running the paid version of Ubuntu called Ubuntu Pro.

To determine which Ubuntu release a server is running, either view the server’s OS Info in the ServerPilot dashboard or run the following command on the server:

cat /etc/lsb-release

Confirm ServerPilot’s mitigation was applied

To confirm ServerPilot’s mitigation was applied, SSH into your server and run the following commands:

if [ -f /etc/modprobe.d/serverpilot-disable-esp4-esp6.conf ]; then echo "File exists"; else echo "File does not exist"; fi
if [ -f /etc/modprobe.d/serverpilot-disable-rxrpc.conf ]; then echo "File exists"; else echo "File does not exist"; fi

If the output from the above command is File exists repeated twice, the mitigation was applied.

Manually apply the mitigation

If you need to manually apply the mitigation, SSH into your server as root and run the following commands:

echo "install esp4 /bin/false" >>/etc/modprobe.d/serverpilot-disable-esp4-esp6.conf
echo "install esp6 /bin/false" >>/etc/modprobe.d/serverpilot-disable-esp4-esp6.conf
echo "install rxrpc /bin/false" >>/etc/modprobe.d/serverpilot-disable-rxrpc.conf

Contact support

If you have questions about your server, please contact support.