What it does

This skill provides a comprehensive, read-only security audit to detect the "Dirty Frag" exploit chain (CVE-2026-43284 and CVE-2026-43500) on Linux systems and containers. It performs 11 distinct checks to determine if a kernel is vulnerable to local privilege escalation via IPsec ESP or RxRPC in-place decryption fast paths.

Why use this skill

Unlike simple version-based scanners, this skill performs deep inspection of the system state. It analyzes kernel build configurations, module blacklists (modprobe.d), socket accessibility for unprivileged users, and active LSM (AppArmor/SELinux) profiles. It identifies cases where blacklisting failed due to modules being built into the kernel (CONFIG_INET_ESP=y), which manual prompting often misses.

Key Features

• Dual-CVE Analysis: Evaluates both components of the Dirty Frag chain simultaneously.
• Environmental Awareness: Detects if the audit is running inside a container or Kubernetes pod, targeting the host kernel's vulnerability state.
• Programmatic Integration: Supports JSON output and exit codes for automated CI/CD gating and SIEM reporting.
• Remediation Guidance: Generates actionable, copy-pasteable mitigation commands and patch instructions.

Output

The skill produces a detailed report of vulnerable conditions found, a JSON-compatible summary of the risk level, and a specific remediation plan based on the environment's configuration (e.g., specific module blacklisting vs. kernel updates).