Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC) — Threadlinqs Intelligence
As of 2026-05-30, Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC) is a critical-severity vulnerability threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 29 indicators of compromise.
Threat ID: TL-2026-0483 · Severity: CRITICAL · CVSS: 7.8 · Status: ACTIVE · Category: VULNERABILITY
Dirty Frag is a universal Linux kernel local privilege escalation that chains two independent page-cache write primitives in the xfrm-ESP (esp4/esp6) IPsec module and the RxRPC module to overwrite the
Dirty Frag is a universal Linux kernel local privilege escalation (LPE) discovered by kernel security researcher Hyunwoo Kim (Twitter handle @v4bel) of Theori. The vulnerability chains two independent but structurally-identical page-cache corruption primitives that reside in kernel cryptographic fast-paths performing in-place AEAD operations on splice()-supplied page references without verifying that the referenced page-cache page is exclusively owned by the caller. The two sub-vulnerabilities are: (1) the xfrm-ESP Page-Cache Write, residing in the IPsec ESP receive-side decryption fast-paths in net/ipv4/esp4.c and net/ipv6/esp6.c, introduced by commit cac2661c53f3 on 2017-01-17 (kernel >= 4.11); and (2) the RxRPC Page-Cache Write, residing in the RxRPC RxKAD encryption send-side fast-path, introduced by commit 2dc334f1a63a in June 2023 (kernel >= 6.5).
In both cases an unprivileged local attacker uses splice() to plant a reference to a read-only page-cache page (for example, the kernel-cached page backing /etc/passwd or /usr/bin/su) into an skb fragment slot. The kernel ESP / RxKAD path then invokes its in-place AEAD transform, which iterates through the skb fragments and encrypts/decrypts each page in-place — silently mutating the underlying page-cache page. Because Linux serves subsequent reads of those files from the cached page until the page is evicted, the attacker has effectively rewritten /etc/passwd or /usr/bin/su for every process on the system without ever modifying the on-disk file. Each primitive yields a 4-byte attacker-controlled write per invocation; the public PoC chains many invocations to either (a) overwrite approximately 192 bytes at offset 0 of /usr/bin/su's page cache with a minimal x86_64 ELF shellcode whose entry point lives at 0x78, then triggers su to execute as root, or (b) blank the password hash field of root in /etc/passwd to exploit PAM's nullok behaviour and obtain root via a normal su.
The xfrm-ESP path requires CAP_NET_ADMIN inside a user namespace, which is available to ordinary users on every major desktop and server distribution that ships kernel.unprivileged_userns_clone=1 (Ubuntu, Debian, Fedora, Arch, openSUSE Tumbleweed, recent RHEL/AlmaLinux/CentOS Stream). The exploit uses setup_userns_netns() to enter a fresh user+net namespace, add_xfrm_sa() to install a Security Association via the xfrm_user Netlink interface, then crafts an ESP packet whose payload references an attacker-staged page-cache page; the receiver-side esp_input() drops the encrypted plaintext directly back into the page-cache page. The RxRPC path is even less restricted: it requires only the ability to create an AF_RXRPC socket (no CAP_NET_ADMIN, no namespacing) and uses rxrpc_client_initiate_call() to start an RxKAD-encrypted call whose zero-copy send buffer carries a splice()-planted page-cache page reference, which the rxkad_secure_packet() transform corrupts in-place via fcrypt_user_decrypt().
Dirty Frag is the third member of a three-bug family (Dirty Pipe — CVE-2022-0847, Copy Fail — CVE-2026-31431 in the algif_aead/AF_ALG interface, and now Dirty Frag) sharing the same root pattern: a kernel subsystem performing in-place writes on pages obtained via splice() without honouring the page's read-only intent. The bug is deterministic (no race condition, no panic-on-failure), has very high reliability on every tested kernel, leaves no on-disk artefact, and bypasses every disk-scanning EDR. Because the disclosure embargo was broken on 2026-05-07 by an unrelated third party before patches were ready, Hyunwoo Kim and the affected maintainers published the full write-up and PoC at https://github.com/V4bel/dirtyfrag with maintainer agreement; as of 2026-05-08 no CVE has been assigned and no upstream patch has shipped.
Impact for defenders: every multi-user Linux host (university clusters, jump hosts, shared CI runners, container hosts), every Linux container with a shared host kernel (Docker, containerd, Kubernetes no
Weaknesses (CWE)
CWE-787, CWE-362, CWE-269, CWE-668, CWE-119
Target sectors: technology, government, financial, healthcare, education, research, manufacturing, telecommunications, cloud-services, managed-service-providers
Target regions: Global, North America, Europe, Asia-Pacific, Latin America, Middle East, Africa
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 29 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
VULNERABILITY, CRITICAL, threat intelligence, cybersecurity, T1068, T1611, T1548.001, T1211, T1222.002, T1070.004, T1006, T1601.001, T1059.004, T1106