Dirty Frag, new Linux zero‑day, gives local attackers root on major distros
Security researcher Hyunwoo Kim disclosed 'Dirty Frag' (CVE-2026-43284 and CVE-2026-43500), two Linux kernel elevation-of-privilege flaws in the IPsec ESP and rxrpc code that a proof-of-concept exploit can use to obtain local root on Ubuntu, Red Hat Enterprise Linux and Fedora. A public PoC repository reproduces the exploit and distribution maintainers have prepared kernel patches and distro-specific fixes that are currently undergoing testing. The flaws follow the Copy Fail class of bugs and specifically target networking and VPN stacks, so compromised VPN endpoints or untrusted local users can escalate to immediate root. System administrators should prioritize testing and deploying the available kernel updates and harden access to local and VPN-exposed hosts until fixes are widely rolled out.
GrapheneOS isn't vulnerable to the 3 recently disclosed Linux kernel vulnerabilities named Copy Fail, Copy Fail 2 and Dirty Frag. Current Android Open Source Project SELinux policies block exploiting all 3 bugs. Standard AOSP GKI kernel configuration also has 2/3 of the vulnerable features disabled.
GrapheneOS29Attack surface reduction via fine-grained SELinux policy rules and stripping out unused kernel features via kernel configuration goes a long way to protecting against vulnerabilities. There's also seccomp-bpf for various standard sandboxes but most of the attack surface reduction is via SELinux.
magnesit4It's crazy how much Android differs from the "default" Linux desktop distribution many have in mind when talking about Linux. So many exploits are just outright not applicable because extensive hardening has been done by the AOSP team alone. Very reassuring.
.Aeto ⌬2I can't believe this is how I learn about Copy Fail 2 How annoying. Gotta take my servers off the internet for a while after all.
