Fortinet says its two flagship products, the FortiOS operating system and FortiGate firewalls, are not affected by a newly disclosed pair of Linux kernel bugs, but the company is still checking whether three of its security tools are exposed. The flaws, nicknamed "Dirty Frag" and tracked as CVE-2026-43284 and CVE-2026-43500, let an attacker who already has a foothold on a machine raise their privileges, a technique known as local privilege escalation. Fortinet's Product Security Incident Response Team (PSIRT) laid out the details in an advisory (FG-IR-26-144). The disclosure lands only weeks after another, more serious kernel bug, Copy Fail (CVE-2026-31431), showed how much attention the Linux kernel's encryption and networking code is getting in 2026.
What's affected
Dirty Frag is actually two separate problems chained together. The first sits in the kernel's xfrm/ESP path (the part of Linux that handles encrypted network traffic, where ESP stands for Encapsulating Security Payload), which decrypts data in place inside shared memory buffers. The second is in the rxrpc protocol handler, in the step that copies certain DATA and RESPONSE network packets. In both cases the kernel tries to decrypt data inside memory it does not exclusively own, corrupting kernel memory in a way a local attacker can turn into elevated access. Fortinet rates the pair 7.9 out of 10 (High) on the CVSS scale, with the vector AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. In plain terms, that means an attacker needs local access and only low privileges to start, no victim interaction is required, and a successful attack fully compromises the system's confidentiality, integrity, and availability.
Which Fortinet products are at risk
The most useful part of the advisory for Fortinet customers is the triage. Three products are still listed as under investigation: FortiEDR, FortiNAC-F, and FortiSOAR. More than three dozen others are confirmed not impacted, including FortiOS, FortiGate, FortiWeb, FortiProxy, FortiManager, and FortiAnalyzer. Fortinet also notes that FortiClient EMS virtual appliances pick up the kernel fix automatically through Ubuntu's unattended-upgrades mechanism. The advisory does not yet list specific fixed versions or workarounds, so anyone running the three products still under review should keep an eye on FG-IR-26-144 for updates.
What you should do
For most Fortinet appliances the practical risk looks limited, because the flagship FortiOS and FortiGate platforms are confirmed safe and because Dirty Frag needs local access rather than being exploitable over the network. The wider lesson is for any organization running Linux servers: a 7.9 local-privilege-escalation chain in the xfrm/ESP and rxrpc paths is a handy tool for an attacker who has already broken in, and shared multi-tenant or container hosts that use these kernel features are the most exposed. Apply your distribution's kernel updates as soon as they ship, and for Fortinet gear specifically, watch the advisory for word on the products still under review.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.