Carbon’s Response to the “Dirty Frag” Linux Vulnerability (CVE-2026-43284, CVE-2026-43500)
May 8, 2026
On May 7, 2026, security researchers publicly disclosed a new flaw in the Linux operating system — the same broad piece of software that runs underneath most of the modern internet, including cloud services, connected devices, and industrial equipment. The flaw has been nicknamed “Dirty Frag” (formal names: CVE-2026-43284 and CVE-2026-43500).
This is the second industry-wide Linux disclosure in just over a week, following the “Copy Fail” vulnerability we responded to on May 1. Like Copy Fail, Dirty Frag is not a Carbon-specific issue — it affects Linux broadly, and security teams at companies around the world are responding to it. We are publishing this post so that our customers, partners, and the broader Carbon community can clearly see how Carbon has responded.
Your Carbon devices have been protected
We applied a security fix overnight on May 7 to all Carbon devices (printers and washers) that were online during the rollout window. This includes printers enrolled in our Version Lock program, as Carbon retains the ability to apply critical security fixes to all printers when necessary.
If your printer or washer was powered-down or offline overnight on May 7 – May 8 (US Pacific Time), it will be protected the next time it reconnects to Carbon’s systems. No action is required from you.
Importantly, this was a security action only. It did not change your installed software version, and it did not alter any core printing or washing functionality.
Carbon’s cloud services were also protected during the same window, ensuring complete coverage across our platform.
What “Dirty Frag” is, in plain terms
Like Copy Fail, Dirty Frag is a flaw that, under specific conditions, could allow someone who already has access to a Linux machine to gain a higher level of control of that machine than they were supposed to have. It does not, by itself, give an outside attacker on the internet a way in. The risk arises when this flaw is combined with some other foothold on a system.
Dirty Frag is a separate flaw from Copy Fail and lives in a different part of the Linux operating system. The fix that addressed Copy Fail does not also address Dirty Frag — a separate response was required, which is why Carbon and other technology providers have moved a second time in a short period.
Carbon’s response
Within hours of the public disclosure, Carbon stood up the same coordinated, top-priority response model we used for Copy Fail. That response included:
- A complete inventory of Linux systems across our cloud services, internal infrastructure, and connected devices.
- Deployment of appropriate fixes across all Carbon hardware and cloud services.
- Active monitoring and threat-hunting across our environment for any indicator of misuse.
A note on the broader landscape
Two industry-wide Linux disclosures in eight days is unusual. The reason for this is that the broader landscape of vulnerability discovery is changing — AI-assisted security research is finding serious flaws faster than the industry has historically been used to, and we expect this pattern to continue. Carbon is investing accordingly to keep our platform secure.
No intrusion detected
As of this writing, we have not detected any sign that Dirty Frag has been used against Carbon systems or customer data. Every action we have taken — and every action we are continuing to take — is defensive and preventative. We will update you if that picture changes in any way that’s relevant to you.
If you have any questions or specific concerns about your environment, please contact support.