Mitel Product Security Advisory MISA-2026-0004

In May 2026, two local privilege escalation vulnerabilities in Linux Kernels were publicly disclosed.

A Local Privilege Escalation Vulnerability, CVE-2026-43284, has been identified in the ESP-in-UDP packet handling (xfrm/esp) component of the Kernel of multiple major Linux distributions, which if successfully exploited, could allow an authenticated attacker with local access to a vulnerable system to conduct local privilege escalation or denial-of-service attack due to missing SKBFL_SHARED_FRAG flags during UDP page splicing, forcing incorrect in-place decryption over shared data. The vulnerability severity is rated as high, based on the assessment provided in the CVE record.

A Local Privilege Escalation Vulnerability, CVE-2026-43500, has been identified in the rxrpc network protocol implementation (DATA/RESPONSE packet handler) of the Kernel of multiple major Linux distributions, which if successfully exploited, could allow an authenticated attacker with local access to a vulnerable system to conduct local privilege escalation or denial-of-service attack due to failing to unshare uncloned packets with external fragments, allowing in-place decryption to modify shared memory. The vulnerability severity is rated as high, based on the assessment provided in the CVE record.

Mitel is actively investigating the impact of CVE-2026-43284 and CVE-2026-43500 on Mitel software and hardware appliances that ship with embedded Linux operating systems or Linux Kernel. Mitel will provide updates as more information becomes available.  

For Mitel applications that are installed on a Linux operating system that is not embedded within the product, Mitel does not provide guidance for the operating system and customers should follow the instructions of the Linux operating system provider. Mitel will not deliver updates for these Linux operating systems.

Windows-based products are not affected by this vulnerability. No action is required for systems running on Microsoft Windows.

Product statements are related only to supported product versions. Products which have reached End of Support status are not considered.

This security advisory provides information on the following products:

Platforms, Solutions and Gateways:

Applications:

Devices:

This section will be updated as Mitel’s investigation continues.

The vulnerability is rated as high severity, based on the assessment provided in the CVE record.

Mitel is actively investigating the impact of CVE-2026-43284 and CVE-2026-43500 on our products and will provide updates as more information becomes available.

Please see Mitel Security Knowledge Base article KB000127880, Linux Kernel Local Privilege Escalation Vulnerabilities "Dirty Frag" Security Update (CVE-2026-43284, CVE-2026-43500).

CVE-2026-43284, CVE-2026-43500