Dirty Frag: New Unpatched Linux Kernel Local Privilege Escalation Vulnerability

In May 2026 researcher Hyunwoo Kim (@v4bel) disclosed “Dirty Frag,” a local privilege-escalation bug after an embargo breach. The vulnerability lives in the esp4, esp6, and rxrpc decryption fast paths, letting an unprivileged user obtain root on most Linux distributions with a single command. No CVE or patches exist yet.

Dirty Frag Vulnerability Made Public Early: Root Privilege On All DistributionsLinux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

Dirty Frag follows deterministic bugs like Dirty Pipe (2022) and Copy Fail (CVE-2026-31431). It does not rely on timing windows, making exploitation reliable, and reuses a 2017 kernel commit that also caused CVE-2022-27666.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

Root access gives full control over the operating system, allowing any privileged operation. The lack of patches leaves many systems exposed to rapid exploitation.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

AlmaLinux reported the bug corrupts externally-backed pages in the esp4, esp6, and rxrpc fast paths. CloudLinx flagged the flaw as reachable via the XFRM netlink interface and the ESP-in-UDP MSG_SPLICE_PAGES no-COW path. Both advise blocklisting the three modules with a modprobe config and unloading them until patches appear; AlmaLinux has issued early test patches.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

The early embargo breach forced disclosure before a CVE could be assigned, limiting coordinated response among downstream distributors and leaving many users without timely remediation.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

Sources differ on CVE assignment; some say none exists yet, others expect one soon. RHEL’s build omits rxrpc.ko, while Ubuntu ships it. Only AlmaLinux offers test patches, and the upstream-fix timeline remains unclear.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

AlmaLinux has released early test patches. Administrators should keep the modprobe blocklist active and monitor vendor advisories.

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

• “Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.” — Hyunwoo Kim, Security Researcher (@v4bel)

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major DistributionsDirty Frag Vulnerability Made Public Early: Root Privilege On All Distributions

• “Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.” — Hyunwoo Kim, Security Researcher (@v4bel)

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

• “Chaining the two variants makes the blind spots cover each other. In an environment where user namespace creation is allowed, the ESP exploit runs first. Conversely, on Ubuntu, where user namespace creation is blocked but rxrpc.ko is built, the RxRPC exploit works.” — Hyunwoo Kim, Security Researcher (@v4bel)

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions

• “The bug lives in the in-place decryption fast paths of esp4, esp6, and rxrpc: when a socket buffer carries paged fragments that are not privately owned by the kernel (e.g., pipe pages attached via splice(2)/sendfile(2)/MSG_SPLICE_PAGES), the receive path decrypts directly over those externally-backed pages, exposing or corrupting plaintext that an unprivileged process still holds a reference to.” — AlmaLinux

Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions