thinQtankLABS

Root-Cause Analysis & Kernel Hardening: CVE-2026-43284 & CVE-2026-43500

Analyze two related Linux kernel CVEs (CVE-2026-43284 and CVE-2026-43500) at the source: recognize the shared root cause (in-place decryption over shared socket-buffer fragments) across IPsec/ESP and RxRPC, read both upstream fixes, then patch both with one update and apply defense-in-depth hardening for both subsystems, and verify.

Expert 21 guided steps 4 tasks About 75 minutes Runs in your browser

Skills you will practice

  • Kernel root-cause analysis
  • Recognizing shared vulnerability classes
  • Reading upstream patches
  • Defense-in-depth hardening
  • Module blacklisting and sysctl
  • Security verification

Certifications this lab maps to

This lab builds hands-on skills that appear on these certification exams. thinQtank Learning runs instructor-led training camps for each — click one to see upcoming classes.

CompTIA SecurityX CAS-005 (CASP+) Secure architecture and system hardening Training at thinQtank Learning CompTIA Linux+ XK0-005 Kernel modules, sysctl and hardening Training at thinQtank Learning ISC2 CISSP CISSP Security architecture and defense in depth Training at thinQtank Learning
Part of these certification lab packages: SecurityX (CASP+) CAS-005 Linux+ XK0-005 CISSP

The scenario

Two CVEs (CVE-2026-43284, CVE-2026-43500) landed in the same fleet. You are the kernel-security engineer. Your first job is to see that they are the same class of bug, which changes how you defend against them.

What you will do

  1. Understand the shared root cause5 steps

    Open the review folder · Read the root-cause note · Read the CVE-2026-43284 patch · Read the CVE-2026-43500 patch · …

  2. Confirm state and score both5 steps

    Check the running kernel · Is it patched? · Score CVE-2026-43284 · CVE-2026-43284 score? · …

  3. Patch and harden both subsystems6 steps

    Boot the patched kernel · Confirm the running kernel · Blacklist xfrm_user · Blacklist rxrpc · …

  4. Verify and reason5 steps

    Verify the module controls · Verify the sysctl hardening · Fix vs. compensating control · Value of spotting the shared class · …

How this lab works

A real Linux-style console. Commands run against real files, so hashes, hex dumps and comparisons give real results.

A file browser where you can place evidence into the lab, either the file provided or one of your own.

Reset a single step, a whole task or the entire lab. The environment is rebuilt so you can try again cleanly.

Progress saves after every step. Close the tab and come back later; your files and answers are waiting.