Vulnerability vector:
- Base vulnerability score (CVSSv3.1): CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
- Severity (CVSSv3.1): 8.8 (high)
- Base vulnerability score (CVSSv4.0): CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L
- Severity (CVSSv4.0): 8.5 (high)
Description:
This security advisory provides information regarding Linux kernel vulnerabilities: CVE-2026-43284 and CVE-2026-43500, informally known as Dirty Frag. These vulnerabilities allow for local privilege escalation to the superuser (root) level and affect the Linux kernel modules: esp4, esp6 and rxrpc.
Vulnerability status: PT NGFW is not affected
Recommendations:
In the default configuration, all models and versions of PT NGFW are not vulnerable to CVE-2026-43284 and CVE-2026-43500: the vulnerable modules esp4, esp6 and rxrpc are not loaded in the Linux kernel.
To verify that the modules are not loaded, follow the procedure below. Commands to prevent the vulnerable modules from loading are listed below:
To check if vulnerable modules are loaded:
lsmod | grep esp4; lsmod | grep esp6; lsmod | grep rxrpc or
kmod list | grep esp4; kmod list | grep esp6; kmod list | grep rxrpc
- If the modules are not loaded, no further action is required.
- If the modules are loaded, unload them manually using the following commands:
sudo rmmod esp4
sudo rmmod esp6
sudo rmmod rxrpc
To forcibly prevent vulnerable modules from loading: sudo nano /etc/modprobe.d/dirtyfrag-blacklist.conf
- Add the following lines to the file:
install esp4 /bin/true
install esp6 /bin/true
install rxrpc /bin/true - Update the current initramfs image: sudo update-initramfs -uk all
- Clear the RAM page cache: sudo sh -c "echo 3 > /proc/sys/vm/drop_caches"
- Reboot the PT NGFW: sudo reboot
Additional information:
Refer to Astra Linux recommendations for disabling the vulnerable module.
If you have any further questions, please contact PT NGFW Technical Support or your account manager.