Root access to local users
What Is Dirty Frag?
Dirty Frag is a new Linux zero-day that allows local attackers to gain root privileges on most major Linux distributions using a single command. It consists of two chained CVEs (CVE-2026-43284 and CVE-2026-43500) that together create a high-severity local privilege escalation (LPE) in the Linux kernel, with a public exploit available before patches were rolled out.
The attack abuses the zero-copy send path where splice() plants a reference to a read-only page cache page, such as /etc/passwd or /usr/bin/su, into a network buffer. The kernel then performs cryptographic operations directly on that page, permanently modifying it in RAM. Every subsequent read to that file sees the corrupted version, even though the attacker was only granted read access.
Because this is a deterministic logic bug with no race condition, no timing window is required, the kernel does not crash on a failed attempt, and the success rate is extremely high.
The Goals of the Dirty Frag exploit
The primary objective is local privilege escalation (LPE): a low-privileged user on a Linux system elevates themselves to root. This allows attackers who already have limited access, through stolen credentials, phishing, or another compromise, to take full control of a system.
On hosts without container workloads, exploitation allows a local user to elevate privileges to root. In container environments running arbitrary third-party workloads, the vulnerability may additionally facilitate container escape, in addition to local privilege escalation on the host.
The exploit covers two attack paths that close each other's blind spots: it first attempts the ESP path and automatically falls back to the RxRPC path targeting /etc/passwd if unshare(CLONE_NEWUSER) fails.
What is targeted?
Affected distributions include Red Hat Enterprise Linux, AlmaLinux, Debian, Ubuntu, Fedora, Arch Linux, CentOS, CloudLinux, Amazon Linux, and others. In practice: virtually every production Linux environment that has not yet been patched.
The ESP vulnerability (CVE-2026-43284) was introduced in January 2017, giving the vulnerability chain an effective window of nearly nine years.
Disclosure was accelerated by a third party breaking the embargo: researcher Hyunwoo Kim privately reported both flaws on April 29-30, 2026, but was forced to publish full documentation and the PoC after a third party broke the embargo on May 7, 2026, before patches were available.
Prevention: Patch or temporary mitigation
Step 1: Patch as soon as possible
For AlmaLinux, patched kernels are available in the production repositories as of May 8, 2026. Update and reboot with sudo dnf clean metadata && sudo dnf upgrade kernel && sudo reboot. After rebooting, verify the patched kernel is running with uname -r. Check your distribution's security advisories for equivalent instructions.
Step 2: Temporary mitigation if immediate patching is not possible
Blacklist the vulnerable kernel modules:
- “echo "install esp4 /bin/false" >> /etc/modprobe.d/dirtyfrag.conf”
- “echo "install esp6 /bin/false" >> /etc/modprobe.d/dirtyfrag.conf”
- “echo "install rxrpc /bin/false" >> /etc/modprobe.d/dirtyfrag.conf”
- “modprobe -r esp4 esp6 rxrpc 2>/dev/null || true”
Be aware that blacklisting esp4/esp6 will break IPsec functionality. Verify whether your systems actively use IPsec or AFS before applying this.
Step 3: Flush the page cache after mitigating
The exploit can modify legitimate system binaries in the page cache as part of gaining root. Mitigation alone is not sufficient on systems that may have been targeted before it was put in place. After mitigating, drop the page cache.
- « sync && echo 3 > /proc/sys/vm/drop_caches »
What does not work
The existing Copy Fail mitigation (blacklisting algif_aead) does not protect against Dirty Frag. Systems that only applied the Copy Fail mitigation remain fully vulnerable.
Conclusion
Dirty Frag is a serious threat to any environment running Linux: the exploit is public, deterministic, and reliable across distributions. Researchers warn that Dirty Frag highlights a growing trend of rapidly weaponized Linux vulnerabilities.
Priority is kernel patching. For systems where that is not immediately possible, apply the module blacklist and flush the page cache. Verify whether IPsec or AFS is in use before permanently blocking the modules. Container environments with multi-tenant workloads warrant extra attention given the risk of container escape.