Linux Kernel [CVE-2026-43284, CVE-2026-43500] New 'Dirty Frag' Vulnerability Grants Root Access

A new critical vulnerability in the Linux kernel, dubbed 'Dirty Frag,' has been disclosed, allowing unprivileged local users to gain full root access on most major Linux distributions securityaffairs.com. This Local Privilege Escalation (LPE) flaw abuses issues in the kernel's page cache handling, specifically impacting the xfrm/ESP (IPsec) and RxRPC subsystems cpanel.net. The most concerning aspect is that 'Dirty Frag' effectively bypasses existing mitigations for the earlier 'Copy.Fail' vulnerability, signaling an escalating sequence of related critical flaws.

What Happened

The 'Dirty Frag' vulnerability, tracked as CVE-2026-43284 and CVE-2026-43500, surfaced with a complicated disclosure process due to an early leak of detailed technical information and an exploit by a third party securityaffairs.com. This flaw affects Linux kernels dating back to approximately 2017 (starting around Linux version 4.14), making a vast array of systems vulnerable premiumsharedhosting.com.

A public Proof-of-Concept (PoC) exploit for 'Dirty Frag' is already available, reportedly making exploitation a single-command operation with a very high success rate securityaffairs.com. This exploit is described as a deterministic logic bug that does not panic the kernel on failure, increasing its reliability for attackers. At the time of initial disclosure, official patches from many upstream maintainers were not yet released, though distributions like AlmaLinux were reportedly testing patched kernels cpanel.net.

Why It Matters

This vulnerability represents a significant threat to the integrity of Linux systems, potentially allowing any unprivileged local user to gain root access. Successful exploitation permits modification of the page cache for files that typically only have read access, such as /etc/passwd or /usr/bin/su premiumsharedhosting.com. This means subsequent legitimate reads of these files would retrieve the malicious, modified copy.

Major Linux distributions are confirmed to be impacted, including Ubuntu (20.04, 22.04, 24.04), RHEL, Fedora, AlmaLinux/Rocky Linux (8, 9, 10), and CloudLinux (7 Hybrid, 8, 9, 10) cpanel.net. The fact that 'Dirty Frag' bypasses mitigations for 'Copy.Fail' means that organizations that diligently patched against the previous flaw are still exposed and require independent remediation. This is the second major instant-root kernel vulnerability discovered in a short period, highlighting mounting pressure on Linux kernel security.

Organizations are advised to implement immediate mitigation strategies by disabling specific Linux kernel modules: esp4, esp6, and rxrpc cpanel.net. After blacklisting, kernel caches should be flushed. This temporarily disables IPsec (ESP) VPNs and AFS, but most regular web servers should remain unaffected. For enhanced endpoint visibility and control during this window, solutions like CrowdStrike Falcon or SentinelOne can help monitor for suspicious local activity indicative of attempted exploitation.

Technical Breakdown

'Dirty Frag' exploits a vulnerability in the Linux kernel's page cache handling, specifically within the xfrm/ESP (IPsec) and RxRPC subsystems cpanel.net. The vulnerability allows an unprivileged local user to inject arbitrary data into the page cache of arbitrary files. This mechanism is similar to how a library might mistakenly let you "borrow" a book, but instead of the original, you're given a copy where a critical page has been swapped out for a malicious one. When anyone else then "borrows" that same book (file), they get the corrupted version, allowing an attacker to manipulate core system files for privilege escalation.

This attack maps directly to T1068 Exploitation for Privilege Escalation in the MITRE ATT&CK framework, as it allows a low-privileged user to execute code with elevated permissions. The impact on critical system files like /etc/passwd also directly correlates to T1003 OS Credential Dumping, as an attacker could modify how credentials are handled or directly inject new root accounts.

From a NIST SP 800-53 perspective, 'Dirty Frag' highlights weaknesses in SI-2 Flaw Remediation because existing mitigations for a related flaw (Copy.Fail) proved insufficient. It also impacts AC-6 Least Privilege, as the vulnerability allows an unprivileged user to bypass privilege boundaries.

Historical Context

'Dirty Frag' is a direct descendant of the 'Dirty Pipe' vulnerability (CVE-2022-0847), discovered in March 2022 by Max Kellermann securityaffairs.com. 'Dirty Pipe' was a significant LPE bug that allowed overwriting arbitrary readable files, including immutable ones, through a pipe buffer mechanism. The critical similarity is the abuse of kernel page cache mechanics to inject data into read-only files, enabling privilege escalation.

More recently, the 'Copy.Fail' vulnerability (CVE-2026-31431) emerged as another related flaw, which also involved issues with kernel memory management and data corruption. What differentiates 'Dirty Frag' is its ability to bypass the mitigations implemented for 'Copy.Fail', demonstrating an escalating and interconnected series of critical Linux kernel flaws that require independent remediation rather than relying on previous patches. This pattern of bypasses in closely related vulnerabilities is a concerning trend for kernel maintainers.

Data at a Glance

Our Take

We're seeing a concerning pattern here: 'Dirty Pipe', 'Copy.Fail', and now 'Dirty Frag'. These aren't isolated incidents; they're all exploiting fundamental page cache issues, often through slightly different attack vectors. The fact that 'Dirty Frag' circumvents existing 'Copy.Fail' patches is a huge red flag, indicating that previous fixes were potentially too narrow. Relying on partial mitigations after the first exploit is clearly not enough. We need kernel developers to take a broader look at the underlying page cache architecture and memory management to address the root causes, rather than playing whack-a-mole with specific exploit techniques.

The CVEDaily Take

The rapid succession and interconnected nature of 'Dirty Pipe', 'Copy.Fail', and 'Dirty Frag' signal a systemic weakness in Linux kernel memory handling that's attracting increasing attention from exploit developers. Organizations must treat these as a class of bugs rather than individual CVEs, requiring a re-evaluation of local privilege separation. Has your team developed a standardized process for identifying and blacklisting kernel modules in emergencies like this?

FAQ

Q: Which Linux kernel modules need to be disabled to mitigate 'Dirty Frag'?
A: To mitigate 'Dirty Frag', you should disable the esp4, esp6, and rxrpc kernel modules, and then flush your kernel caches.

Q: Does patching against 'Copy.Fail' protect systems from 'Dirty Frag'?
A: No, 'Dirty Frag' specifically bypasses the mitigations put in place for the 'Copy.Fail' vulnerability, meaning systems patched against 'Copy.Fail' are still exposed.

Q: What is the primary impact of a successful 'Dirty Frag' exploit?
A: A successful 'Dirty Frag' exploit allows an unprivileged local user to gain full root access by modifying the page cache of files they typically only have read access to, such as /etc/passwd, leading to privilege escalation.