New Dirty Frag Linux Bug Emerges

A new class of Linux kernel vulnerabilities, called "Dirty Frag," has emerged, allowing an unprivileged local user to escalate privileges to root on most Linux distributions. The vulnerability class is a potent new iteration of kernel bugs that corrupt the page cache of read-only files to grant full system control and is a follow-on to the recently disclosed Copy Fail Linux LPE bug. 

Dirty Frag achieves its powerful local privilege escalation (LPE) by chaining two separate vulnerabilities: the xfrm-ESP Page-Cache Write and the RxRPC Page-Cache Writeflaws. But, like Copy Fail, this is a locally exploitable vulnerability, so an attacker would need an account on the target machine.

The Core Mechanism of Dirty Frag

Dirty Frag, discovered and reported by security researcher Hyunwoo Kim, belongs to the same family as the Dirty Pipe and Copy Fail vulnerabilities. Like its predecessors, it exploits an issue  stemming from the kernel's memory management and zero-copy optimization paths. The flaw affects many major Linux distributions, including Ubuntu, RHEL, openSUSE, Fedora, and others.

There’s no patch available at the moment, because an embargo on the details of the vulnerability was broken Thursday by a third party, so the researcher published the full write up to give the community all of the information, as well. Kim did submit a patch to the Linux kernel maintainers, but it has not landed upstream yet.

At its core, the vulnerability exploits a flaw in the Linux kernel’s handling of a zero-copy send path where the splice() system call plants a reference to a page cache page into the frag slot of a network buffer (struct sk_buff). This page cache page originates from a file the attacker only has read access to, such as /etc/passwd or /usr/bin/su.

When subsequent kernel code on the receiver side performs an in-place cryptographic operation on this fragment, it unknowingly writes (performs a STORE) directly on the file's read-only page cache stored in RAM. The file on disk remains unmodified, but every subsequent read operation system-wide uses the corrupted in-memory copy, which is modified by the unprivileged attacker. This is a highly effective technique, as demonstrated by Copy Fail (CVE-2026-31431), which also enabled unprivileged users to obtain root by corrupting a setuid binary's page cache.

“Copy Fail was the motivation for starting this research. In particular, xfrm-ESP Page-Cache Write in the Dirty Frag vulnerability chain shares the same sink as Copy Fail. However, it is triggered regardless of whether the algif_aead module is available. In other words, even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, your Linux is still vulnerable to Dirty Frag,” Kim said in the advisory. 

The Chained Vulnerabilities

The two individual flaws comprising Dirty Frag reproduce this core pattern:

1. xfrm-ESP Page-Cache Write: The esp_input function bypasses the security-critical skb_cow_data check. This allows it to run crypto_authenc_esn_decryptdirectly on the sk_buff fragment, executing an in-place crypto operation on a read-only page.
2. RxRPC Page-Cache Write: Similarly, the rxkad_verify_packet_1function performs an in-place single-block decrypt with pcbc(fcrypt)directly on the fragment.

Bypassing Existing Mitigations

One of the most worrying aspects of Dirty Frag is its resilience against previous defenses. Copy Fail's disclosure led many organizations to consider mitigating it by restricting access to the cryptographic socket interface, such as disabling the algif_aead module.

Dirty Frag, however, can be triggered regardless of whether the algif_aeadmodule is available. This means that systems protected by the publicly known mitigation for Copy Fail are still vulnerable to this new class of attack, underscoring the ongoing challenge of addressing fundamental zero-copy data path issues in the Linux kernel.