Scenario

• Product: ZCF
• Components: ZCE-X, ZStack Cloud
• ZCE-X version: 5.2.x
• ZStack Cloud version: 4.8.x
• Trigger: A scan detects the privilege-escalation vulnerability CVE-2026-43284, requiring kernel-module remediation.

Symptoms

• The environment is affected by CVE-2026-43284.
• The vulnerability is related to esp4, esp6, and rxrpc kernel modules.
• Remediation permanently disables and unloads these modules.

Assessment

1. Confirm the maintenance window and high-availability arrangement before remediation.
2. Verify that modprobe -n -v redirects the modules to /bin/false after remediation.
3. Verify that lsmod no longer lists the modules.

Cause

Remediation does not rely on application-layer configuration. Block and unload the esp4, esp6, and rxrpc host kernel modules to eliminate the privilege-escalation risk.

Resolution

1. Preparation

• Risk level: Low.
• Disable global VM high availability.
• Back up databases on both management nodes.
• Process one host at a time and continue only after verification succeeds.

2. Back up databases:

   zstack-ctl dump_mysql
   zstack-ctl dump_mysql

• Expected result: Platform data is protected by backups.

3. Disable kernel modules permanently:

   printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

• Expected result: Requests to load the modules are blocked.

4. Unload currently loaded modules:

   rmmod esp4 esp6 rxrpc 2>/dev/null; true

• Expected result: Target modules already in memory are unloaded.

5. Verify that modules are disabled:

   modprobe -n -v esp4
   modprobe -n -v esp6
   modprobe -n -v rxrpc

• Expected result: Output shows that each module is redirected to /bin/false.

6. Verify that modules are absent from memory:

   lsmod | grep -E "esp4|esp6|rxrpc"

• Expected result: No matching output is returned.

7. Enable global VM high availability after confirming no exception.

• Expected result: Remediation is complete and normal platform operation is restored.

Verification

• Verify the contents of dirtyfrag.conf.
• Verify that modprobe -n -v prevents normal module loading.
• Verify that lsmod has no esp4, esp6, or rxrpc entries.
• Verify normal platform and workload operation.

Risks and rollback

• Risk: Evaluate dependencies before disabling modules in environments that might use them.
• Risk level: Low.
• No rollback is required for this security-vulnerability remediation.