Details have emerged about a new, unpatched local privilege escalation (LPE) vulnerability impacting the Linux kernel. Dubbed Dirty Frag, it has been described as a successor to Copy Fail (CVE-2026-31431), a recently disclosed LPE flaw that has since come under active exploitation in the wild.
The Vulnerability: A Deterministic Logic Bug
“Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability,” security researcher Hyunwoo Kim (@v4bel) said in a write-up.
Unlike many kernel exploits that rely on race conditions or timing windows, Dirty Frag is a deterministic logic bug. This means:
- No race condition required: The exploit doesn’t depend on precise timing
- High success rate: The kernel doesn’t panic when the exploit fails
- Predictable execution: The bug follows a consistent logical path
The vulnerability currently does not have a CVE identifier, as the embargo was broken after detailed information and the exploit for the xfrm-ESP Page-Cache Write vulnerability were published publicly by an unrelated third-party.
Affected Distributions
Successful exploitation could allow an unprivileged local user to gain elevated root access on most major Linux distributions, including:
- Ubuntu 24.04.4
- RHEL 10.1
- openSUSE Tumbleweed
- CentOS Stream 10
- AlmaLinux 10
- Fedora 44
The Two Exploit Variants
1. xfrm-ESP Page-Cache Write
Rooted in the IPSec (xfrm) subsystem, this variant was introduced in a source code commit made in January 2017. Interestingly, the same commit was the root cause behind another buffer overflow (CVE-2022-27666) that affected various Linux distributions.
This exploit provides attackers with a 4-byte store primitive like Copy Fail, allowing them to overwrite a small amount in the kernel’s page cache. However, it requires the unprivileged user to create a namespace—a step that’s blocked by Ubuntu through AppArmor.
2. RxRPC Page-Cache Write
Introduced in June 2023, this variant does not require the privilege to create a namespace. However, the rxrpc.ko module itself is not included in most distributions. For example, the default build of RHEL 10.1 does not ship rxrpc.ko, but Ubuntu loads it by default.
The Chain: Covering Each Other’s Blind Spots
“Chaining the two variants makes the blind spots cover each other,” Kim explained. “In an environment where user namespace creation is allowed, the ESP exploit runs first. Conversely, on Ubuntu, where user namespace creation is blocked but rxrpc.ko is built, the RxRPC exploit works.”
This chaining mechanism ensures that Dirty Frag works across virtually all major distributions, regardless of their specific security configurations.
Technical Deep Dive: The Root Cause
CloudLinx described the flaw as residing in the “ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path and is reachable via the XFRM user netlink interface.”
AlmaLinux elaborated: “The bug lives in the in-place decryption fast paths of esp4, esp6, and rxrpc: when a socket buffer carries paged fragments that are not privately owned by the kernel (e.g., pipe pages attached via splice(2)/sendfile(2)/MSG_SPLICE_PAGES), the receive path decrypts directly over those externally-backed pages, exposing or corrupting plaintext that an unprivileged process still holds a reference to.”
In simpler terms: when the kernel decrypts data that belongs to user space (not kernel-owned memory), it writes directly over that memory without making a copy. This allows an unprivileged user to read or modify kernel data by manipulating the shared memory pages.
Immediate Mitigation
Until patches are available, it’s advised to blocklist the esp4, esp6, and rxrpc modules so they cannot be loaded:
sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"Important note: Dirty Frag can be triggered regardless of whether the algif_aead module is available. This means that even on systems where the Copy Fail mitigation (algif_aead blacklist) is applied, your Linux system is still vulnerable to Dirty Frag.
Reflection: The “Dirty” Legacy Continues
1. The Page Cache Attack Surface
Dirty Frag joins a growing family of “Dirty” vulnerabilities:
- Dirty COW (2016): Race condition in copy-on-write
- Dirty Pipe (2022): Pipe buffer overwrite
- Copy Fail (2026): algif_aead page cache write
- Dirty Frag (2026): ESP/RxRPC page cache write
The pattern is clear: the Linux kernel’s page cache management is a recurring attack surface. The fundamental issue is that the kernel trusts certain memory pages to be “safe” when they’re actually shared with user space. This trust assumption has been violated repeatedly over nearly a decade.
2. The Embosure Problem
Dirty Frag doesn’t have a CVE because the embargo was broken. This highlights a systemic issue in vulnerability disclosure:
- Researchers report responsibly to maintainers
- Maintainers need time to develop and test patches
- Third parties leak details prematurely
- Result: Zero-day exploits in the wild before fixes are ready
This cycle leaves defenders powerless. Without a CVE, many security tools can’t track the vulnerability. Without patches, administrators can only mitigate (not fix). And with public PoCs, attackers have a roadmap.
3. The Nine-Year-Old Bug
The xfrm-ESP variant was introduced in January 2017—nearly a decade ago. This raises uncomfortable questions:
- How many similar bugs are lurking in old commits?
- Why did it take nine years to discover this?
- Are we getting better at finding bugs, or are bugs getting easier to find?
The answer is likely all three. Code auditing tools have improved, but the kernel has also grown exponentially. The attack surface is larger, and the complexity is higher.
4. Distribution-Specific Security
Dirty Frag’s chaining mechanism exploits differences between distributions:
- Ubuntu: Blocks namespace creation (AppArmor) but includes rxrpc.ko
- RHEL: Allows namespace creation but excludes rxrpc.ko
This is a reminder that “security through diversity” only works if attackers don’t chain exploits. When two different security decisions create two different attack vectors, the net result is less security, not more.
Lessons for System Administrators
1. Assume Local Access = Root Access
Dirty Frag proves that once an attacker has local unprivileged access, root is often just a command away. This means:
- Multi-tenant systems are inherently risky
- Container escapes become full system compromises
- Untrusted users on shared hosts should be treated as adversaries
2. Mitigate Aggressively
Don’t wait for patches. If you’re not using IPSec (ESP) or RxRPC, blocklist the modules now. The performance impact is negligible, and the risk reduction is significant.
3. Monitor for Exploitation
Watch for:
- Unexpected module loading (esp4, esp6, rxrpc)
- Unprivileged users creating namespaces (where allowed)
- Sudden privilege escalation events
- Kernel panic patterns that match PoC behavior
Conclusion
Dirty Frag is a stark reminder that the Linux kernel, despite decades of scrutiny, still harbors deep-seated logic bugs that can be weaponized for root access. The fact that this vulnerability chain affects virtually every major distribution—and has existed in some form for nearly a decade—should humble us all.
In the cat-and-mouse game of kernel security, the mice are getting smarter. The only winning move is to assume breach, mitigate aggressively, and patch the moment fixes become available.
