This advisory addresses the Linux kernel vulnerabilities known as "Copy Fail" (CVE-2026-31431) and "Dirty Frag" (CVE-2026-43284 and CVE-2026-43500). Publicly available research indicates these vulnerabilities may allow an unprivileged local user to achieve local privilege escalation on affected systems. Remote exploitation is not possible with these vulnerabilities. The published exploit shows that in non-containerized deployments, a local user can gain root privileges. In containerized environments that execute arbitrary or untrusted third-party workloads, these vulnerabilities could potentially be leveraged to facilitate container escape and host compromisedscenarios.

CVE-2026-31431

In the Linux kernel, the following vulnerability has been resolved: crypto: algif_aead - Revert to operating out-of-place. This change primarily undoes commit 72548b093ee3, with the exception of how associated data is copied. As the source and destination stem from different mappings, there’s no advantage to in-place operations in algif_aead. Remove complexity added for in-place operation and copy the AD directly.

CVE-2026-43284, CVE-2026-43500

Two related vulnerabilities, collectively referred to as "Dirty Frag," exist in the IPsec (ESP) and RxRPC networking stacks of the Linux kernel. An unprivileged local attacker can exploit these vulnerabilities to deterministically overwrite the kernel Page Cache, enabling Local Privilege Escalation (LPE) to full root-level control.

Given the high severity of these issues, users should apply the solutions immediately to reduce security risks.

The Identified Vulnerability Type and Potential Impact

Vulnerability Scoring Details

Solutions

The table below lists all affected product series. Users should follow the solutions below to remediate affected systems.

Update Instructions

Affected products run either Moxa Industrial Linux (MIL) or Debian Linux. Each OS type requires a different update procedure. Before proceeding, confirm your device's OS type from the Affected Products table, then follow the corresponding section below.

The following packages are available to remediate affected systems.

For MIL-based Products

MIL-based products receive security updates through the Moxa apt server.

Select the procedure that matches your network environment:

• Online: your device has direct access to the Moxa apt server.
• Offline: your device operates in an air-gapped or restricted network.

Online update procedures

Offline update procedures

This procedure is intended for systems operating in air-gapped environments.

Prerequisites

• An internet-connected staging machine of the same product model and MIL system version as the target system.

Offline Phase 1 - Download on Staging Machine

• Transfer the downloaded .deb files to the target system via an authorized secure medium (e.g., approved USB drive) per your enterprise security policy.

Offline Phase 2 - Install on Target System

• Back up critical configuration files or take a system snapshot.

• Navigate to the directory containing the transferred .deb files and install:

• Note: If dependency errors occur, ensure all required dependency packages are included.

Post-Update Verification

• After updating the security patches, the system must be rebooted. After the system has rebooted, perform a version check to ensure the update was successful.

• Run the following command for each package listed under your product series in the Packages List above:

Post-Update Cleanup

If you previously applied the interim mitigations, check Mitigation Removal to remove them after the update has been successfully applied and verified.

For Debian-based Products

The BXP, DRP, and RKP Series run Debian Linux. Security updates are applied through the Debian security repository and the Moxa x86 SDK.

Select the procedure that matches your network environment:

• Online: your device has direct access to the Debian security repository.
• Offline: your device operates in an air-gapped or restricted network.

Prerequisites

Download the x86 SDK from the Resources tab on the product page on the Moxa website.

Update Procedures

• Step 1 - Add the Debian security repository

  • Online: run on the target system. Offline: run on the staging machine.

  • Debian 11 (Bullseye):

    echo "deb http://security.debian.org/debian-security bullseye-security main contrib non-free" | sudo tee -a /etc/apt/sources.list

  • Debian 12 (Bookworm):

    echo "deb http://security.debian.org/debian-security bookworm-security main contrib non-free non-free-firmware" | sudo tee -a /etc/apt/sources.list

• Step 2 - Update the package index and upgrade the kernel

  • Online

    • sudo apt-get update

      sudo apt-get install --only-upgrade linux-image-amd64 -y

  • Offline
    • Download on staging machine

    • sudo apt-get update

      mkdir /tmp/cve-update && cd /tmp/cve-update

      sudo apt-get download linux-image-amd64

    • Transfer the downloaded .deb files to the target system via an authorized secure medium. Then on the target system, back up critical configuration files and install:

    • cd /path/to/deb-files/

      sudo dpkg -i *.deb

    • Note: If dependency errors occur, ensure all required dependency packages are included.

• Step 3 - Reinstall the x86 SDK

  • Reinstall the x86 SDK to rebuild the kernel modules against the updated kernel.

  • unzip <downloaded_sdk>.zip

    cd Moxa_x86_Linux_SDK_<ver>_Build_<build_date>

    ./install.sh -y

• Step 4 - Reboot the system

  • reboot

• Step 5 - Cleanup
  • If you previously applied the interim mitigations, check Mitigation Removal to remove them after the update has been successfully applied and verified.

Mitigations

Interim Mitigation — Module Blacklisting

When updates cannot be deployed immediately, the following mitigation can be applied. This procedure disables the vulnerable kernel modules and effectively closes the known attack vectors for CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500 on affected systems.

IMPORTANT: Before applying this mitigation, read the Functional Impact Analysis section below. Disabling IPsec modules (esp4/esp6) will interrupt all VPN tunnels. Do not apply this mitigation blindly on systems that depend on IPsec for network connectivity. Additionally, Step 3 (flushing the page cache) may cause a brief I/O performance degradation as cached data must be reloaded from the disk. It is recommended to execute this step during a scheduled maintenance window on I/O-intensive systems.

Step 1: Mitigate CVE-2026-31431 (algif_aead module)

For AIG-302 and UC-8200 Series:

algif_aead is compiled as a built-in kernel module in this firmware and cannot be removed at runtime via modprobe or blacklisting. The only mitigation is to block its initialization at boot using the initcall_blacklist kernel parameter.

⚠️ These commands modify bootloader environment variables directly. A mistake may render the device unbootable and require manual recovery via serial console. Physical access is required before proceeding.

⚠️ Before rebooting, verify the changes

Confirm the output matches the values set above, then reboot the device for the changes to take effect.

Once the firmware update with the official fix is applied, revert the boot configuration:

For All Other Products:

Create blacklist configuration, unload module, and verify:

No output indicates module is not loaded.

Step 2: Mitigate CVE-2026-43284 (esp4/esp6 modules - IPsec)

Determining If IPsec Is in Use

Check if your system has the esp4/esp6 modules loaded:

If no output is returned, IPsec is not running and you can safely use the blocklist method. If the modules appear in the output, verify whether IPsec is configured by checking:

If either command shows active entries, IPsec is in use. Choose the appropriate method below based on your IPsec requirements.

Blocklist Method

Warning: This method disables IPsec. Only use if your system does not require IPsec connectivity.

User Namespace Restriction Method

This approach maintains IPsec functionality by restricting unprivileged user namespaces instead of disabling the esp4/esp6 modules.

Warning: Rootless containers, browser sandboxing features, and Flatpak will be affected. Root containers and regular applications continue to function normally.

Step 3: Mitigate CVE-2026-43500 (rxrpc module)

The rxrpc module provides RxRPC protocol support for AFS (Andrew File System). Most industrial deployments do not use AFS. Disable the module using:

No output indicates the module is successfully disabled.

Step 4: Verification

Confirm that all targeted modules are no longer loaded:

No output confirms successful mitigation. If any modules remain loaded, they are in active use by running connections. Schedule a system reboot during your next maintenance window to complete the mitigation.

Step 5: Drop Page Cache (Optional)

⚠️ Note: This causes a temporary increase in disk I/O as the cache repopulates. On file servers or database servers, expect a brief period of reduced read performance.

Functional Impact Analysis — Read Before Applying

• algif_aead: Minimal impact. Affects only custom applications using the Linux userspace crypto socket API. Standard industrial applications are not affected.

• esp4 / esp6 (IPsec):

  • Blocklist Method: High impact. Disabling these modules will immediately terminate all IPsec/VPN tunnels and prevent them from restarting. Do not use this method on devices where IPsec is required for network communications or OT/IT segregation.

  • User Namespace Restriction Method: Preserves IPsec functionality but affects rootless containers (Docker/Podman), sandboxed browsers, and Flatpak applications. Privileged containers and standard applications are not affected.

• rxrpc: Minimal expected impact. RxRPC is a specialized Linux networking protocol and is not used by standard Moxa industrial applications or typical default deployments. Disabling the rxrpc module is not expected to affect normal device operation. Customers running customized applications, third-party packages, or non-standard integrations should confirm that RxRPC is not required in their environment before applying this mitigation.

Products Confirmed Not Affected

Only products listed in the Affected Products and Solutions section of this advisory are confirmed to be affected by these vulnerabilities. The products confirmed not affected are listed below.

• UC Series: UC-2100 Series, UC-3100 Series, UC-5100 Series, UC-8100 Series, UC-8100A-ME-T Series, UC-8100-ME-T Series, UC-8200 Series (MIL1), UC-8410A Series, UC-8540 Series

• V Series: V2201 Series, V2403C Series, V2406C Series

• AIG Series: AIG-101 Series, AIG-301 Series, AIG-501 Series

• All other Inductrial Computing products such as DA Series, MC Series, and Panel PCs, etc.

Revision History