Linux Kernel (Dirty Frag): Mehrere Schwachstellen ermöglichen Erlangen von Administratorrechten
WID-SEC-2026-1430 · first 08.05.2026 · updated 04.09.2026 · CVSS 7,8
What it is about
Der Kernel stellt den Kern des Linux Betriebssystems dar. Ein lokaler Angreifer kann mehrere Schwachstellen im Linux Kernel ausnutzen, um Administratorrechte zu erlangen.
Under what conditions?
Only with access to the device or an account on it. Often the second step after a phishing email.
What can happen in the worst case
An attacker could use the vulnerability to
- Administratorrechte zu erlangen
Am I affected?
Affected according to the BSI:
- Dell NetWorker
- Debian Linux
- Google Cloud Platform
- Amazon Linux 2
- Red Hat Enterprise Linux
- Fedora Linux
- Mitel MiCollab
- Ubuntu Linux
- SUSE Linux
- Oracle Linux
- QNAP NAS
- Red Hat OpenShift Container Platform
and 30 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Open Source Linux Kernel <=7.0.4
- Open Source Linux Kernel 6.6.138
- Open Source Linux Kernel 6.12.87
- Open Source Linux Kernel 6.18.28
- Open Source Linux Kernel 7.0.5
- Red Hat OpenShift Container Platform 4.20.22
- Red Hat OpenShift Container Platform 4.14.66
- Red Hat OpenShift Container Platform 4.12.91
- IBM QRadar SIEM 7.5.0 UP15 IF04
- Moxa MXsecurity v2.3.3
- Red Hat OpenShift Container Platform 4.13.68
- Dell Secure Connect Gateway 5.36.00.16
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- DirtyFrag GitHub vom 2026-05-07 github.com
- Microsoft Security Blog vom 2026-05-10 www.microsoft.com
- Oracle Linux Security Advisory ELSA-2026-50257 vom 2026-05-10 linux.oracle.com
- Debian Security Advisory DSA-6253 vom 2026-05-08 lists.debian.org
- SUSE Security Update SUSE-SU-2026:1778-1 vom 2026-05-08 lists.suse.com
- Debian Security Advisory DSA-6258 vom 2026-05-09 lists.debian.org
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-290 vom 2026-05-09 alas.aws.amazon.com
- Oracle Linux Security Advisory ELSA-2026-50259 vom 2026-05-10 linux.oracle.com
- Oracle Linux Security Advisory ELSA-2026-50258 vom 2026-05-10 linux.oracle.com
- Fedora Security Advisory FEDORA-2026-87DC12705E vom 2026-05-08 bodhi.fedoraproject.org
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-294 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-293 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-292 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-291 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2LIVEPATCH-2026-289 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2KERNEL-5.4-2026-121 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2KERNEL-5.15-2026-102 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2KERNEL-5.10-2026-118 vom 2026-05-09 alas.aws.amazon.com
- Amazon Linux Security Advisory ALAS2-2026-3302 vom 2026-05-09 alas.aws.amazon.com
- Debian Security Advisory DLA-4574 vom 2026-05-09 lists.debian.org
- Debian Security Advisory DLA-4572 vom 2026-05-08 lists.debian.org
- Fedora Security Advisory FEDORA-2026-ABC00FB4E8 vom 2026-05-08 bodhi.fedoraproject.org
- Fedora Security Advisory FEDORA-2026-8CFFA03DAD vom 2026-05-08 bodhi.fedoraproject.org
- QNAP Security Advisory QSA-26-17 vom 2026-05-11 www.qnap.com
- Red Hat Security Advisory RHSA-2026:16062 vom 2026-05-12 access.redhat.com
and 239 more sources in the original advisory
CVE: CVE-2026-43284, CVE-2026-43500
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.