A local privilege escalation vulnerability (CVE-2026-43284, CVSS 8.8 High) in the Linux kernel, dubbed "Dirty Frag," allows a local attacker to gain elevated privileges on affected QNAP NAS devices. The vulnerability affects Linux kernel versions 4.11 through 5.10.254, 5.12 through 5.15.204, 5.16 through 6.1.170, 6.2 through 6.6.137, and 6.7 through 6.12.86. Patched kernel versions are 5.10.255, 5.15.205, 6.1.171, 6.6.138, 6.12.87, 6.18.28, and 7.0.5; until these updates are applied by QNAP, administrators should restrict shell access for non-administrators, secure containers, disable unused services, and ensure the NAS is not directly exposed to the internet.
A vulnerability was identified in QNAP NAS. A local attacker can exploit this vulnerability to trigger elevation of privilege on the targeted system. Note: CVE-2026-43284 is being scattered exploited. A local privilege escalation vulnerability, commonly known as "Dirty Frag", ... Impact Elevation of Privilege System / Technologies affected All QNAP ARM64-based NAS models All QNAP x86-based NAS models All QuTS hero NAS models All QuTScloud NAS instances Solutions Workaround: Mitigate the vulnerability of attacks by following workaround: Restrict Shell Access: Revoke SSH or Telnet terminal permissions for all non-administrator accounts. Container Security: Deploy only trusted images within Container Station and avoid running containers with "Privileged" mode enabled. Minimize Attack Surface: Disable unused services, such as the Web Server, and uninstall non-essential third-party applications. Network Isolation: Ensure your NAS is not directly exposed to the internet. Utilize QuFirewall or a VPN to restrict access to trusted internal networks only. Please visit the vendor web-site for more details. Apply workarounds issued by the vendor: https://www.qnap.com/en/security-advisory/qsa-26-17