A security researcher has disclosed a chain of three vulnerabilities in the Linux kernel that allows a local, unprivileged attacker to escalate to root by corrupting the kernel’s page cache. The exploit, dubbed “Kukurigu,” has a near-perfect success rate and works without race conditions.
The attack chains three separate CVEs together. CVE-2026-43284 targets the xfrm-ESP protocol implementation, letting an attacker perform arbitrary 4-byte writes into the page cache. CVE-2026-43500 exploits the RxRPC protocol to decrypt data in place within page-cache pages. And CVE-2026-46300, called “Fragnesia,” abuses a bug in skb_try_coalesce() to write to the page cache via fragmented ESP packets.
By chaining these flaws, an attacker can modify the memory-resident pages of setuid binaries like /usr/bin/su or /usr/bin/sudo, or tamper with sensitive system files like /etc/passwd. Because the modification happens in the page cache, the attacker effectively poisons the execution environment without touching disk.
What makes this particularly dangerous is the reliability. There are no race conditions involved, the success rate is close to 100%, and failed attempts don’t trigger kernel panics. The vulnerability spans kernels dating back to January 2017 — nearly nine years of releases.
Affected distributions that have been verified include Ubuntu 24.04.4, 25.10, and 26.04, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44. The researcher, nu11secur1ty, has published proof-of-concept code and a detailed write-up.
System administrators should check with their distribution vendor for patched kernel versions and apply updates as soon as they become available. Given the severity and the wide range of affected kernels, this is one to prioritize.
