In the Linux kernel

#!/usr/bin/env bash
# check-cve-2026-43284.sh
# Best-effort exposure check for CVE-2026-43284 (Dirty Frag xfrm/ESP path)
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN, 3=ERROR

set -u

CVE="CVE-2026-43284"
KREL="$(uname -r 2>/dev/null)"
OS_ID=""
OS_VERSION_ID=""
STATUS="UNKNOWN"
REASON="insufficient version mapping"

log() { printf '%s\n' "$*"; }

have_cmd() { command -v "$1" >/dev/null 2>&1; }

load_os_release() {
  if [[ -r /etc/os-release ]]; then
    # shellcheck disable=SC1091
    . /etc/os-release
    OS_ID="${ID:-}"
    OS_VERSION_ID="${VERSION_ID:-}"
  fi
}

module_available() {
  local m="$1"
  if grep -qE "^${m} " /proc/modules 2>/dev/null; then
    return 0
  fi
  if have_cmd modinfo && modinfo "$m" >/dev/null 2>&1; then
    return 0
  fi
  return 1
}

module_blacklisted() {
  local m="$1"
  grep -RhsE "^[[:space:]]*install[[:space:]]+${m}[[:space:]]+/bin/false|^[[:space:]]*blacklist[[:space:]]+${m}([[:space:]]|$)" \
    /etc/modprobe.d /run/modprobe.d /usr/lib/modprobe.d /lib/modprobe.d 2>/dev/null | grep -q .
}

config_enabled() {
  local sym="$1"
  if [[ -r /proc/config.gz ]] && have_cmd zgrep; then
    zgrep -qE "^${sym}=(y|m)$" /proc/config.gz 2>/dev/null && return 0
  fi
  if [[ -r "/boot/config-${KREL}" ]]; then
    grep -qE "^${sym}=(y|m)$" "/boot/config-${KREL}" 2>/dev/null && return 0
  fi
  return 1
}

ver_lt() {
  # dpkg --compare-versions style if available, otherwise sort -V fallback
  local a="$1" b="$2"
  if have_cmd dpkg; then
    dpkg --compare-versions "$a" lt "$b"
    return $?
  fi
  [[ "$(printf '%s\n%s\n' "$a" "$b" | sort -V | head -n1)" == "$a" && "$a" != "$b" ]]
}

print_summary() {
  log "${STATUS}"
  log "reason=${REASON}"
  log "kernel=${KREL}"
  [[ -n "$OS_ID" ]] && log "os=${OS_ID} ${OS_VERSION_ID}"
  exit "$1"
}

load_os_release

ESP4_AVAIL=0
ESP6_AVAIL=0
ESP4_BL=1
ESP6_BL=1
CFG4=1
CFG6=1

module_available esp4 && ESP4_AVAIL=1
module_available esp6 && ESP6_AVAIL=1
module_blacklisted esp4 && ESP4_BL=0 || ESP4_BL=1
module_blacklisted esp6 && ESP6_BL=0 || ESP6_BL=1
config_enabled CONFIG_INET_ESP && CFG4=0 || CFG4=1
config_enabled CONFIG_INET6_ESP && CFG6=0 || CFG6=1

# If neither module is available and neither feature is compiled in, host is effectively not exposed.
if [[ $ESP4_AVAIL -eq 0 && $ESP6_AVAIL -eq 0 && $CFG4 -ne 0 && $CFG6 -ne 0 ]]; then
  STATUS="PATCHED"
  REASON="esp4/esp6 not present and kernel config does not expose ESP support"
  print_summary 0
fi

# If everything is blacklisted and not loaded, treat as effectively mitigated.
if [[ $ESP4_AVAIL -eq 1 || $ESP6_AVAIL -eq 1 || $CFG4 -eq 0 || $CFG6 -eq 0 ]]; then
  if [[ $ESP4_BL -eq 0 && $ESP6_BL -eq 0 ]] && ! grep -qE '^(esp4|esp6) ' /proc/modules 2>/dev/null; then
    STATUS="PATCHED"
    REASON="esp4/esp6 blacklisted and not loaded; host effectively mitigated"
    print_summary 0
  fi
fi

# Best-effort Debian family mapping from Debian tracker fixed versions.
# This checks installed package metadata where available; vendor backports on other distros are not covered.
if [[ "$OS_ID" =~ ^(debian|ubuntu)$ ]] && have_cmd dpkg-query; then
  PKGVER=""
  if dpkg-query -W -f='${Version}\n' linux-image-"$KREL" >/dev/null 2>&1; then
    PKGVER="$(dpkg-query -W -f='${Version}\n' linux-image-"$KREL" 2>/dev/null | head -n1)"
  elif dpkg-query -W -f='${Version}\n' linux-image-generic >/dev/null 2>&1; then
    PKGVER="$(dpkg-query -W -f='${Version}\n' linux-image-generic 2>/dev/null | head -n1)"
  fi

  if [[ -n "$PKGVER" ]]; then
    case "$OS_VERSION_ID" in
      11*) FIX="5.10.251-4" ;;
      12*) FIX="6.1.170-3" ;;
      13*) FIX="6.12.86-1" ;;
      *) FIX="" ;;
    esac

    if [[ -n "$FIX" ]]; then
      if ver_lt "$PKGVER" "$FIX"; then
        STATUS="VULNERABLE"
        REASON="Debian-family package version ${PKGVER} is older than known fixed floor ${FIX}"
        print_summary 1
      else
        STATUS="PATCHED"
        REASON="Debian-family package version ${PKGVER} meets or exceeds known fixed floor ${FIX}"
        print_summary 0
      fi
    fi
  fi
fi

# Mainline-only hint: 7.1-rc3 carries the upstream fix, but enterprise distros may backport below this.
if [[ "$KREL" =~ ^7\.1 ]]; then
  STATUS="PATCHED"
  REASON="running a 7.1-series kernel; upstream mainline fix is documented in 7.1-rc3"
  print_summary 0
fi

# Exposure-oriented fallback.
if [[ $ESP4_AVAIL -eq 1 || $ESP6_AVAIL -eq 1 || $CFG4 -eq 0 || $CFG6 -eq 0 ]]; then
  STATUS="UNKNOWN"
  REASON="ESP support present or available, but exact vendor backport level could not be verified automatically"
  print_summary 2
fi

STATUS="UNKNOWN"
REASON="could not determine kernel exposure"
print_summary 2