Dirty Frag mitigation (CVE-2026-43284 xfrm-ESP / CVE-2026-43500 RxRPC). Standalone shell script — superseded by an Ansible role; kept for hosts not under config management.

dirty-frag-mitigation.sh

#!/usr/bin/env bash
# Dirty Frag mitigation + verification
# CVE-2026-43284 (xfrm-ESP) / CVE-2026-43500 (RxRPC)
# Works on Rocky/RHEL and Arch — idempotent, no reboot required.

set -euo pipefail

CONF=/etc/modprobe.d/dirtyfrag.conf
MODS=(esp4 esp6 rxrpc)

[[ $EUID -eq 0 ]] || {
  echo "must run as root" >&2
  exit 1
}

echo "=== Dirty Frag mitigation ==="
echo "host:   $(hostname)"
echo "kernel: $(uname -r)"
echo

# 1. report whether vulnerable .ko files are present on this kernel
echo "[1/5] vulnerable modules on disk:"
for m in "${MODS[@]}"; do
  f=$(find "/lib/modules/$(uname -r)" -name "${m}.ko*" 2>/dev/null | head -1)
  [[ -n $f ]] && echo "  - $m: $f" || echo "  - $m: not built for this kernel"
done
echo

# 2. write blacklist
echo "[2/5] writing $CONF"
cat >"$CONF" <<'EOF'
# Dirty Frag mitigation — block xfrm-ESP and RxRPC page-cache-write LPE
# CVE-2026-43284 (esp4/esp6), CVE-2026-43500 (rxrpc)
# Remove this file once distro kernel ships backports.
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
EOF
chmod 0644 "$CONF"

# 3. unload anything currently loaded
echo "[3/5] unloading currently loaded modules:"
for m in "${MODS[@]}"; do
  if lsmod | awk '{print $1}' | grep -qx "$m"; then
    if rmmod "$m" 2>/dev/null; then
      echo "  - $m: unloaded"
    else
      echo "  - $m: in use, could not unload (reboot to clear)"
    fi
  else
    echo "  - $m: not loaded"
  fi
done

# 4. flush page cache (cleans up if exploit had been run pre-mitigation)
echo "[4/5] flushing page cache"
sync
echo 3 >/proc/sys/vm/drop_caches
echo "  - done"

# 5. verify autoload is blocked (dry-run, does not execute /bin/false)
echo
echo "[5/5] verifying autoload is blocked:"
fail=0
for m in "${MODS[@]}"; do
  if modprobe -n -v "$m" 2>&1 | grep -q '/bin/false'; then
    echo "  - $m: BLOCKED ✓"
  else
    echo "  - $m: NOT BLOCKED ✗"
    fail=1
  fi
done

echo
if [[ $fail -eq 0 ]]; then
  echo "=== mitigation applied successfully — no reboot required ==="
  exit 0
else
  echo "=== mitigation FAILED — investigate $CONF and modprobe config ==="
  exit 2
fi