Dirty Frag: Linux Kernel LPE Chain with Public PoC and Patches…

Dirty Frag is a two-vulnerability chain in the Linux kernel that enables root escalation on nearly all distributions. Mainline patches are published, but a working proof-of-concept is already in the wild.

On May 7, 2026, an unidentified third party broke the embargo on the Dirty Frag vulnerability, publishing technical details and a working proof-of-concept that enables escalation to root privileges on nearly all major Linux distributions. Discovered by researcher Hyunwoo Kim (@v4bel) and reported to maintainers on April 30, the chain combines two kernel page-cache write primitives — CVE-2026-43284 (xfrm-ESP) and CVE-2026-43500 (RxRPC) — to achieve deterministic administrative access without race conditions. Microsoft has already detected limited in-the-wild activity attributable to this class of exploit.

Key Takeaways

Dirty Frag is a two-vulnerability LPE chain in the Linux kernel: xfrm-ESP (CVE-2026-43284) and RxRPC (CVE-2026-43500), which allow selective overwrite of setuid files in the page cache.
The exploit is deterministic, with a very high success rate and no race conditions; the kernel does not panic on failure, allowing repeated attempts.
The chaining covers distribution blind spots: ESP requires user namespaces (available on RHEL, blocked on Ubuntu), while RxRPC requires the rxrpc.ko module (loaded by default on Ubuntu, absent on RHEL).
Microsoft observes limited in-the-wild activity with escalation via the 'su' command after SSH access, attributable to Dirty Frag or the related Copy Fail vulnerability (CVE-2026-31431).
Mainline patches are available at commits f4c50a4034e6 and aa54b1d27fe0; temporary mitigation via blacklisting the esp4, esp6, and rxrpc modules.

The Mechanism: Writing to the Page Cache as a Direct Path to Root

The technical core of Dirty Frag lies in corrupting the page cache through in-place decryption on paged fragments not exclusively owned by the kernel. Kim identified two subsystems — xfrm-ESP IPsec and RxRPC — that enable this write via pipe pages generated through splice, sendfile, and MSG_SPLICE_PAGES. Both paths produce the same primitive: a selective 4-byte overwrite of memory-mapped files, sufficient to alter setuid binaries and obtain a root shell.

The xfrm-ESP variant traces back to a January 2017 commit, sharing the same root cause as CVE-2022-27666. The RxRPC variant originates from a June 2023 commit. Their combination is not coincidental: it constitutes an architectural response to fragmented defenses. Kim explicitly designed the chaining so that one distribution's restrictions become the attack vector for the other. On RHEL 10.1, where user namespace creation is permitted but rxrpc.ko is not included by default, the exploit takes the ESP path. On Ubuntu, where AppArmor blocks user namespaces but loads rxrpc.ko by default, the RxRPC path achieves the same result.

The Geometry of Partial Defenses: When Mitigating Equals Exposing

Wiz Research has confirmed the analysis: the two page-cache write primitives allow modification of memory "not exclusively kernel-owned," resulting in corruption of sensitive files and escalation to root. The paradoxical aspect, documented in the technical brief, is that a mitigation on one distribution creates vulnerability on the other. By blocking user namespaces, Ubuntu indirectly privileged the loading of rxrpc.ko as an alternative attack surface. By reducing the module footprint, RHEL left the ESP path open.

This dynamic has immediate implications for multi-tenant environments. On hosts without containers, Dirty Frag achieves root LPE with a single command. In containers running arbitrary workloads, the same chain facilitates container escape scenarios — although Wiz notes the exploit typically requires CAP_NET_ADMIN, making success less likely in containerized environments with default seccomp active.

"Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability" — Hyunwoo Kim (@v4bel)

Deterministic, Public, Already Observed: The Triplet Accelerating the Threat

Dirty Frag does not introduce a new bug class, but inherits and refines the most dangerous characteristics of its predecessors. Kim emphasized that it is a "deterministic logic bug that does not depend on a timing window": no race conditions, no synchronization requirements, no kernel panic on failure. The success rate is very high. These characteristics, combined with the publication of a working PoC on May 8, 2026, drastically lower the barrier to entry for threat actors.

Microsoft has further elevated the risk profile, announcing the monitoring of "limited in-the-wild activity" that employs the 'su' command for escalation after initial SSH access. Microsoft's statement specifies that this activity "may be indicative of techniques associated with either Dirty Frag or Copy Fail" — the vulnerability CVE-2026-31431 previously cataloged in the CISA KEV. The link is not attributive but classificatory: both vulnerabilities share the page-cache write mechanism and the same operational reliability.

Dirty Frag explicitly bypasses the publicly known mitigation for Copy Fail, the blacklisting of the algif_aead module. Kim verified that the exploit "can be triggered regardless of whether the algif_aead module is available": systems believed protected by the previous mitigation remain exposed.

Immediate Actions

Apply mainline patches at commits f4c50a4034e6 (CVE-2026-43284) and aa54b1d27fe0 (CVE-2026-43500), available in the official kernel release notes.
Temporarily implement blacklisting of the esp4, esp6, and rxrpc modules through kernel module mechanisms, acknowledging that this action disables IPsec and AFS functionality with operational impact.
Verify that AppArmor or equivalent policies for user namespace restriction are effectively operational, without assuming they independently block Dirty Frag due to the alternative RxRPC path.
Monitor logs for local escalation patterns via 'su' following SSH sessions, consistent with the behavior reported by Microsoft in in-the-wild activity.

Why This Chain Changes the Linux Risk Calculus

Dirty Frag does not represent a marginal extension of the page-cache write bug class: it demonstrates its systematic nature. The deliberate adoption of chaining as a strategy for evading distribution-level mitigations indicates that researchers, and consequently threat actors, are treating partial defenses as designable vectors rather than obstacles. The progression from Copy Fail to Dirty Frag, both with public PoCs and reported in-the-wild activity, suggests this attack surface will remain fertile.

For organizations managing Linux infrastructure, the tension lies between patching speed and coverage completeness. Mainline patches exist, but the forced disclosure from the broken embargo has compressed the response window. The need to disable core networking and filesystem modules — not marginal workarounds but functional disruptions — indicates that temporary mitigation carries measurable operational costs. The stakes are not merely technical: they concern the sustainability of the Linux kernel's defense distribution model, where fragmentation of security policies across vendors is becoming an attack multiplier.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references