Why treat Dirty Frag separately from Copy Fail?
CVE-2026-43284 (“Dirty Frag”) was published to NVD on 8 May 2026 with a kernel.org CNA CVSS 3.1 score of 8.8 (High). The mainline fix is f4c50a4034e6 (7.1-rc3); stable lines include 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28 and 7.0.5. Related CVE-2026-43500 was closed in the same wave on some distros; RHEL 6–10 and SLES 15 SP7 are listed as not affected for that second CVE (e.g. rxrpc module not shipped).
Copy Fail (CVE-2026-31431) sits on the AF_ALG/crypto path; Dirty Frag is a different kernel surface. You must verify both patches on the same host—one USN/RHSA does not mean “all 2026 LPEs are done.”
Distro status (summary)
- Ubuntu: 22.04 (e.g. 5.15.0-181), 24.04 (6.8.0-124) and 26.04 (7.0.0-22) lines include kernels fixed for both CVEs. 18.04 / 20.04 fixes ship via Ubuntu Pro.
- Debian: 11 DLA-4572-1 (5.10.251-4), 12 DSA-6258-1, 13 DSA-6253-1.
- RHEL 8/9/10: CVE-2026-43284 via RHSA-2026:16195 / 16206 / 16062. CVE-2026-43500 is not applicable on RHEL.
In September 2026 Ubuntu is still shipping cumulative kernel notices (e.g. USN-8816-1 on 24 September 2026; USN-8729-3 on 21 September 2026). Those close additional subsystem flaws beyond Dirty Frag; do not stop at a single CVE—apply the current meta-package and reboot.
Practical checklist on dedicated and cloud
- List pending kernel packages with
apt list --upgradable | grep linux-imageordnf updateinfo list sec. - Patch and reboot a canary host; verify NIC/bonding and storage drivers.
- Compare
uname -rto the package version—wrong meta-packages on Ubuntu HWE / cloud kernels are a common miss. - On VMware guests (VMSA-2026-0006 is a separate track), finish the Linux kernel patch in the same period; hypervisor and guest patches do not substitute for each other.
On KuzeyDC unmanaged dedicated and cloud Linux, patch discipline is your RACI. Take a snapshot or backup and write the window into the customer SLA. Official sources: Ubuntu Security Notices, Debian DSA/DLA, Red Hat CVE-2026-43284.