Introduction

The recently disclosed Dirty Frag vulnerability sent shockwaves through the Linux community. This local privilege escalation (LPE) bug, tracked as CVE-2026-43500 with a CVSS score of 7.8 (HIGH), allowed a local attacker to tamper with kernel memory during decryption and gain root access. The flaw originated from a 2019 commit that mishandled certain packet types in the rxrpc subsystem. Fortunately, a proper patch has arrived in Linux 7.0.6 and 6.18.29 LTS, and major distributions have already rolled out fixes. This guide walks you through securing your system step by step.

What You Need

• A Linux distribution (Fedora 42/43/44, Pop!_OS 22.04/24.04, or any distribution that can manually install kernels)
• Root or sudo access
• A stable internet connection
• Backup of important data (especially if performing manual kernel upgrade)
• Basic familiarity with the terminal

Step-by-Step Instructions

Step 1: Check Your Current Kernel Version

Before updating, identify which kernel you are running. Open a terminal and execute:

uname -r

This shows the kernel version, e.g., 7.0.4-100.fc43.x86_64 or 6.18.28-.... If it ends with .29 or higher for LTS, or is 7.0.6, you're patched. Otherwise proceed.

Step 2: Update on Fedora

Fedora maintainer Justin Forbes has already pushed the fix to stable branches. Fedora 43 and 44 users receive the patched kernel in version 7.0.4 (they skipped 7.0.5). Fedora 42 gets 6.19.14-101. Run:

sudo dnf update

This lists available updates. Confirm you see kernel packages like kernel-7.0.4-100.fc43. Then upgrade:

sudo dnf upgrade

Press Y when prompted. Once complete, reboot (see Tips).

Step 3: Update on Pop!_OS

System76 has released kernel updates for Pop!_OS 22.04 and 24.04 LTS. The fix addresses both Dirty frag CVEs. For the rxrpc module, they chose to disable it rather than patch it. Run:

sudo apt update && sudo apt upgrade

After the upgrade completes, reboot with:

sudo reboot

Note that rxrpc will be disabled; if you need it, contact System76 support.

Step 4: Update on Other Distributions (Manual Kernel Installation)

If you use a distribution that hasn't received an automatic update, you can manually install Linux 7.0.6 or 6.18.29 LTS from kernel.org. Warning: This is risky – only proceed if you have backed up your data.

1. Download the appropriate tarball from kernel.org (e.g., linux-7.0.6.tar.xz).
2. Follow your distribution's guide for building and installing a custom kernel. For Ubuntu-based systems, we have a separate guide (linked below).
3. After installation, reboot into the new kernel. Verify with uname -r as in Step 1.

For Ubuntu/Debian users, refer to our step-by-step manual kernel upgrade guide (internal link placeholder).

Step 5: Verify the Patch Applied

After updating and rebooting, confirm the vulnerability is patched:

• Check kernel version: uname -r should show 7.0.6 (or 7.0.4 on Fedora 43/44, or 6.19.14-101 on Fedora 42).
• Check CVE status: Run zgrep CVE-2026-43500 /proc/config.gz or view your package changelog. On Fedora: rpm -q --changelog kernel | grep CVE-2026-43500. On Pop: dpkg -l | grep linux-image and check version against known patched ones.
• Optional: Try to reproduce the exploit (do not do this on production systems).

Tips for a Smooth Update

• Always back up before any kernel upgrade, especially if manual. Use rsync or your backup tool of choice.
• Reboot after update – the patched kernel only loads after a restart. Do sudo reboot immediately after upgrade.
• Keep your system updated regularly; fixes often come faster than you think.
• For Pop!_OS users: the rxrpc module is disabled. If you rely on it (e.g., for AFS or certain network tasks), check System76 for an alternative or consider compiling your own kernel with the patch.
• For Fedora users: note that the update skipped version 7.0.5 – 7.0.4 already contains the fix, so don't be surprised if you see no newer version.
• If using a distribution other than Fedora/Pop, check its package repository for a backported fix first. Manual tarball installation is only for experienced users.

For more details on the Dirty Frag vulnerability and its discovery, see our full coverage.