Critical Linux Kernel Flaws in Hitachi Energy APM Edge Allow Root Privilege Escalation
Two critical vulnerabilities in the Linux kernel, affecting Hitachi Energy's APM Edge product, enable local unprivileged users to escalate privileges to root.
Hitachi Energy's APM Edge product, specifically versions 6.10 and prior, is currently affected by two critical vulnerabilities that could allow unprivileged local users to gain root-level access. These flaws, identified as CVE-2026-43284 and CVE-2026-43500, stem from issues within the Linux kernel's IPsec ESP and RxRPC protocol implementations, respectively.
The first vulnerability, CVE-2026-43284, is a "write-what-where" condition within the IPsec ESP subsystem of the Linux kernel. This flaw allows an attacker to craft specific network packets that cause the kernel to decrypt data directly into memory pages it does not own. This includes cached copies of critical operating system binaries. When these compromised binaries are subsequently executed, the attacker's injected code runs with the highest level of privilege, effectively granting them root access. In the context of APM Edge, the vulnerable kernel modules (esp4, esp6) can be loaded by any local user, making exploitation feasible.
Complementing this is CVE-2026-43500, an "out-of-bounds write" vulnerability in the RxRPC protocol implementation of the Linux kernel. Similar to the first flaw, RxRPC incorrectly processes incoming network packets containing externally owned memory fragments. During this processing, the kernel writes decrypted data into unauthorized memory pages, including those holding privileged system binaries. The consequence is the same: an attacker can inject malicious code that executes with root privileges when a corrupted binary is run. The vulnerable rxrpc kernel module in APM Edge can also be loaded by any local user.
Successful exploitation of either of these vulnerabilities could have severe consequences for the confidentiality, integrity, and availability of the Hitachi Energy APM Edge product. Given the critical nature of these flaws and the potential for complete system compromise, CISA has assigned a high severity rating to both, with CVSS base scores of 8.8 for CVE-2026-43284 and 7.8 for CVE-2026-43500.
Hitachi Energy has acknowledged these vulnerabilities, which are collectively referred to as "Dirty Frag." The company's recommended immediate action for mitigation is to disable the vulnerable kernel modules: esp4 and esp6 for CVE-2026-43284, and rxrpc for CVE-2026-43500. While these mitigations can reduce the attack surface, they may impact the functionality of the APM Edge product, necessitating careful evaluation by affected organizations.
These vulnerabilities underscore the persistent risks associated with the underlying components of industrial control system (ICS) products. Even when vulnerabilities are not directly in the vendor's proprietary code, flaws in common operating system kernels or libraries can have a widespread impact. The ability for local, unprivileged users to escalate to root privileges is a particularly dangerous scenario, as it bypasses initial access controls and allows for deep system manipulation.
Organizations deploying Hitachi Energy APM Edge versions 6.10 and prior are strongly advised to consult CISA's advisory and Hitachi Energy's guidance for detailed remediation steps. Implementing the suggested mitigations, such as disabling the affected kernel modules, should be a priority. Furthermore, adhering to general security best practices for ICS environments, including network segmentation, minimizing internet exposure, and robust access controls, remains crucial in defending against potential exploitation.
The widespread deployment of Hitachi Energy products across the global energy sector means that these vulnerabilities could affect critical infrastructure worldwide. Prompt attention to patching or applying mitigations is essential to prevent potential disruptions and maintain the security and operational integrity of these vital systems.
This new advisory from Zero Day Initiative details a race condition vulnerability within the Linux Kernel's XFRM subsystem. While previous reports focused on vulnerabilities affecting specific products like Hitachi Energy APM Edge, this disclosure highlights a flaw inherent to the core kernel that could impact a broader range of Linux-based systems. The vulnerability requires prior high-privileged code execution for exploitation and has been assigned a CVSS score of 7.5.