A new local privilege escalation (LPE) vulnerability known as Dirty Frag is causing serious concern in the Linux ecosystem after researchers revealed that the flaw could grant root access on most major Linux distributions. The vulnerability, which remains unpatched for now, has been described as a successor to the previously disclosed Copy Fail, tracked as CVE-2026-31431.
See also: ZiChatBot Malware: Malicious PyPI Packages Target Windows and Linux
Security researcher Hyunwoo Kim, known online as @v4bel, publicly disclosed the issue after what he described as a breakdown in the coordinated disclosure and embargo process. The vulnerability was initially reported to Linux kernel maintainers on April 30, 2026, but no official fixes or CVE identifiers had been assigned at the time of disclosure.
According to Kim, Dirty Frag is not a single bug, but a class of vulnerabilities that can achieve root privileges on many Linux distributions by combining two separate bugs: the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability .
Kim explained in his technical article: "Dirty Frag is a class of vulnerability that achieves root privileges on most Linux distributions by combining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability."
Additionally, he noted that Dirty Frag extends the same class of bugs related to Dirty Pipe and Copy Fail (CVE-2026-31431). Unlike race condition-based attacks, Dirty Frag operates via a deterministic logic error, making the exploit more reliable.
See also: New malware turns Linux systems into P2P attack networks
«Because it is a deterministic logic error that does not depend on a time window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.»
Dirty Frag Targets Multiple Linux Distributions
The new LPE vulnerability affects a wide range of Linux distributions, including Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44.The researchers warned that successful exploitation allows an unprivileged local user to escalate privileges and gain full root access.
In a public disclosure sent to the oss-security mailing list on May 8, 2026, Kim described Dirty Frag as a “universal LPE for Linux” capable of compromising all major Linux distributions. The disclosure stated: “This is a report on ‘Dirty Frag’, a universal LPE that allows for gaining root privileges on all major distributions.”
Until official fixes are available, administrators are advised to manually disable the affected modules. The recommended mitigation command is:
sudo sh -c “printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true”
See also: CISA adds Linux vulnerability to KEV List
Security experts also warned that Dirty Frag is significantly different from CVE-2026-31431. Unlike Copy Fail, Dirty Frag can be exploited even if the Linux kernel's algif_aead module is disabled.
🔒 Protect your privacy with Proton VPN
Swiss VPN from the creators of Proton Mail — strict no-logs policy, strong encryption, and built-in NetShield that blocks ads, trackers, & malware.
- ✔ No-logs, based in Switzerland (except 14-Eyes)
- ✔ NetShield: blocks ads, trackers & malicious domains
- ✔ Covers all devices — free version available
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
