Skip to content
topics.

Dirty Frag, new Linux zero‑day, gives local attackers root on major distros

techMay 8, 202618290

Security researcher Hyunwoo Kim disclosed Dirty Frag, tracked as CVE-2026-43284 and CVE-2026-43500, a Linux kernel local privilege escalation that can give local attackers root on major distributions including Ubuntu, RHEL and Fedora. Kim published a proof-of-concept exploit showing the bug stems from the algif_aead cryptographic interface introduced about nine years ago and it affects IPsec ESP and rxrpc handling. Distribution maintainers and kernel developers have produced patches and testing kernels, with AlmaLinux and others publishing builds to testing repositories; immediate workarounds include unloading or disabling the esp4, esp6 and rxrpc modules until patched kernels are applied. This matters because the public PoC enables immediate local exploitation on multiuser and server systems, so administrators should apply vendor patches or disable the affected modules now.

GrapheneOS
@grapheneos.org

GrapheneOS isn't vulnerable to the 3 recently disclosed Linux kernel vulnerabilities named Copy Fail, Copy Fail 2 and Dirty Frag. Current Android Open Source Project SELinux policies block exploiting all 3 bugs. Standard AOSP GKI kernel configuration also has 2/3 of the vulnerable features disabled.

120Yesterday
GrapheneOS29

Attack surface reduction via fine-grained SELinux policy rules and stripping out unused kernel features via kernel configuration goes a long way to protecting against vulnerabilities. There's also seccomp-bpf for various standard sandboxes but most of the attack surface reduction is via SELinux.

magnesit4

It's crazy how much Android differs from the "default" Linux desktop distribution many have in mind when talking about Linux. So many exploits are just outright not applicable because extensive hardening has been done by the AOSP team alone. Very reassuring.

.Aeto ⌬2

I can't believe this is how I learn about Copy Fail 2 How annoying. Gotta take my servers off the internet for a while after all.

Liam @ GamingOnLinux
@gamingonlinux.com

Linux security flaws Dirty Frag and Copy Fail are a good reminder to stay up to date #Linux #OpenSource #Security

5918h ago
Brodie Robertson
@brodierobertson.xyz

Copy Fail 2 by the name of Dirty Frag just dropped a few hours back and since a 3rd party found the exploit the reporter had to break embargo so basically no distros are patched phoronix.com/news/Dirty-F... I know both Nix and KDE Linux are both shipping the temporary fix.

18Yesterday
Thomas Fuchs
@thomasfuchs.at

Heads-up if you run Linux servers, another very bad security vulnerability dropped, here‘s Ubuntu’s post on ”Dirty Frag”. Patch asap. ubuntu.com/blog/dirty-f...

127h ago
The Register
@theregister.com

'Dirty Frag' Linux flaw one-ups CopyFail with no patches and public root exploit

813h ago
Phoronix
@phoronix-poster.bsky.social

Dirty Frag Vulnerability Made Public Early: Root Privilege On All Distributions - https://www.phoronix.com/news/Dirty-Frag-Linux

11Yesterday
Sisyphus, but for reducing tail latency
@bluespacecanary.bsky.social

You can tell we've made genuine progress on security because local privilege escalations get hyped like this now lol. No RCE, no remote key disclosure, no hypervisor escape, literally just local user -> root

Devastating 'Dirty Frag' exploit leaks out, gives immediate root access on most Linux machines since 2017, no patches available, no warning given — Copy Fail-like vulnerability had its embargo broken
1016h ago
New In Linux
@newinlinux.bsky.social

A vulnerability allowing normal users to gain root privileges was publicly disclosed Thursday. Following on the heels of Copy Fail, this one is called "Dirty Frag," and it affects all #Linux distributions. www.newinlinux.com/dirty-frag-v...

3Yesterday
InfoSec
@infosec.skyfleet.blue

New Linux 'Dirty Frag' zero-day gives root on all major distros

618h ago
winter
@winter.bsky.social

(these (copyfail2 and dirty frag) are the same vulns, fwiw)

8Yesterday
Best of r/cybersecurity
@cybersecurity.page

Researchers have disclosed "Dirty Frag," a Linux kernel vulnerability involving page-cache corruption in the decryption fast path that could allow local privilege escalation to root. It's similar to past flaws like Dirty Pipe, affecting multi-user and containerized environments.

516h ago
9to5Linux.com
@9to5linux.com

Dirty Frag #Linux Kernel Flaw Allows Local Privilege Escalation, Patch Now 9to5linux.com/dirty-frag-l...

613h ago
Microsoft Threat Intelligence
@threatintel.microsoft.com

Similar to the previously disclosed Copy Fail vulnerability (CVE-2026-31431), the exploit attempts to manipulate Linux page cache behavior to achieve privilege escalation. However, Dirty Frag introduces additional attack paths that expand exploitation opportunities and improve reliability.

59h ago
Linuxiac
@linuxiac.bsky.social

Dirty Frag follows Copy Fail with a new Linux kernel local privilege escalation risk affecting major distributions and server environments. linuxiac.com/after-copy-f... #Linux #Kernel #OpenSource #Security

312h ago
Zak
@zacksryl.bsky.social

Rough week for Linux security exploits, it seems. Two major ones in the span of just one, tough stuff. Thankfully, there is a manual fix for DIrty Frag until distros get around to patching it & Copy Fail should be patched by all distros soon(ish) enough.

412h ago
3 sources
bleepingcomputer.comNew Linux 'Dirty Frag' zero-day gives root on all major distrosshare.transistor.fmLinux Dirty Frag and the Canvas Breach Escalation [Prime Cyber Insights]almalinux.orgDirty Frag (CVE-2026-43284, CVE-2026-43500) vulnerability fix is ready for testing

Related

Canvas hack strands students during finals, universities postpone examstechParis prosecutors open criminal probe into Elon Musk over X contenttechTruth Social parent reports $405M quarterly losstechDirty Frag, new Linux zero‑day, gives local attackers root on major distrostech