Blacklisting vulnerable kernel modules esp4, esp6, rxrpc
Mitigation for CVE-2026-43284 / DirtyFrag

Introduction

With CVE-2026-43284 (also called DirtyFrag) a local privilege escalation vulnerability was discovered in the Linux Kernel. This affects all Mindbreeze InSpire appliances that have version 26.2 or older installed.

With the Mindbreeze InSpire 26.3 Release the vulnerability will be mitigated by blacklisting the vulnerable modules.

A non-vulnerable kernel will be provided in an upcoming Mindbreeze InSpire Release.

For older Mindbreeze InSpire installations, the vulnerable modules can be blacklisted manually with the steps presented in the following chapters.

Attention: The mitigation steps disable IPSec functionality as IPSec kernel modules are affected by this security issue..

Deployment of the Mitigation

The following steps should be performed on all member nodes of a Mindbreeze InSpire cluster:

1. Login via SSH to the Mindbreeze InSpire server using root credentials.
2. Run the following command:

printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/blacklist-dirtyfrag.conf

1. Then, run this command:

rmmod esp4 esp6 rxrpc 2>/dev/null

1. Reboot the appliance.

Verification

If correctly deployed, the following command should output:

Command: modprobe esp4

Output:

modprobe: ERROR: libkmod/libkmod-module.c:796 command_do() Error running install command '/bin/false' for module esp4: retcode 1

modprobe: ERROR: could not insert 'esp4': Invalid argument