Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC)
Linux Kernel 'Dirty Frag' Universal Local Privilege (TL-2026-0483), also tracked as Dirty Frag, is a critical-severity software vulnerability scored CVSS 7.8, first published 2026-05-08. It has no confirmed attribution, affects Linux Kernel Linux Kernel (xfrm-ESP), maps to 20 MITRE ATT&CK techniques (T1003.008, T1006, T1059.004), and is covered by 9 detection rules and 29 indicators of compromise.
Key facts for TL-2026-0483
- Threat ID
- TL-2026-0483
- Also known as
- Dirty Frag, DirtyFrag, v4bel LPE, esp4-rxrpc page cache write
- Severity
- CRITICAL
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-05-08
- Last reviewed
- 2026-05-08
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, government, financial, healthcare, education, research, manufacturing, telecommunications, cloud-services, managed-service-providers
- Target regions
- Global, North America, Europe, Asia-Pacific, Latin America, Middle East, Africa
- Detection rules
- 9
- Indicators of compromise
- 29
Dirty Frag is a universal Linux kernel local privilege escalation that chains two independent page-cache write primitives in the xfrm-ESP (esp4/esp6) IPsec module and the RxRPC module to overwrite the in-memory page cache of read-only files such as /etc/passwd and /usr/bin/su, granting root on every major distribution. Discovered by Hyunwoo Kim (@v4bel) of Theori, the bug is deterministic, requires no race window, leaves disk content untouched, and a complete weaponised PoC (V4bel/dirtyfrag) was published 2026-05-07 after the coordinated-disclosure embargo was prematurely broken. As of 2026-05-08 there is no CVE assignment and no upstream kernel patch is available, leaving every Linux multi-tenant host, container host, jump server, and CI runner exposed.
How Linux Kernel 'Dirty Frag' Universal Local Privilege works
Dirty Frag is a universal Linux kernel local privilege escalation (LPE) discovered by kernel security researcher Hyunwoo Kim (Twitter handle @v4bel) of Theori. The vulnerability chains two independent but structurally-identical page-cache corruption primitives that reside in kernel cryptographic fast-paths performing in-place AEAD operations on splice()-supplied page references without verifying that the referenced page-cache page is exclusively owned by the caller. The two sub-vulnerabilities are: (1) the xfrm-ESP Page-Cache Write, residing in the IPsec ESP receive-side decryption fast-paths in net/ipv4/esp4.c and net/ipv6/esp6.c, introduced by commit cac2661c53f3 on 2017-01-17 (kernel >= 4.11); and (2) the RxRPC Page-Cache Write, residing in the RxRPC RxKAD encryption send-side fast-path, introduced by commit 2dc334f1a63a in June 2023 (kernel >= 6.5).
In both cases an unprivileged local attacker uses splice() to plant a reference to a read-only page-cache page (for example, the kernel-cached page backing /etc/passwd or /usr/bin/su) into an skb fragment slot. The kernel ESP / RxKAD path then invokes its in-place AEAD transform, which iterates through the skb fragments and encrypts/decrypts each page in-place — silently mutating the underlying page-cache page. Because Linux serves subsequent reads of those files from the cached page until the page is evicted, the attacker has effectively rewritten /etc/passwd or /usr/bin/su for every process on the system without ever modifying the on-disk file. Each primitive yields a 4-byte attacker-controlled write per invocation; the public PoC chains many invocations to either (a) overwrite approximately 192 bytes at offset 0 of /usr/bin/su's page cache with a minimal x86_64 ELF shellcode whose entry point lives at 0x78, then triggers su to execute as root, or (b) blank the password hash field of root in /etc/passwd to exploit PAM's nullok behaviour and obtain root via a normal su.
The xfrm-ESP path requires CAP_NET_ADMIN inside a user namespace, which is available to ordinary users on every major desktop and server distribution that ships kernel.unprivileged_userns_clone=1 (Ubuntu, Debian, Fedora, Arch, openSUSE Tumbleweed, recent RHEL/AlmaLinux/CentOS Stream). The exploit uses setup_userns_netns() to enter a fresh user+net namespace, add_xfrm_sa() to install a Security Association via the xfrm_user Netlink interface, then crafts an ESP packet whose payload references an attacker-staged page-cache page; the receiver-side esp_input() drops the encrypted plaintext directly back into the page-cache page. The RxRPC path is even less restricted: it requires only the ability to create an AF_RXRPC socket (no CAP_NET_ADMIN, no namespacing) and uses rxrpc_client_initiate_call() to start an RxKAD-encrypted call whose zero-copy send buffer carries a splice()-planted page-cache page reference, which the rxkad_secure_packet() transform corrupts in-place via fcrypt_user_decrypt().
Dirty Frag is the third member of a three-bug family (Dirty Pipe — CVE-2022-0847, Copy Fail — CVE-2026-31431 in the algif_aead/AF_ALG interface, and now Dirty Frag) sharing the same root pattern: a kernel subsystem performing in-place writes on pages obtained via splice() without honouring the page's read-only intent. The bug is deterministic (no race condition, no panic-on-failure), has very high reliability on every tested kernel, leaves no on-disk artefact, and bypasses every disk-scanning EDR. Because the disclosure embargo was broken on 2026-05-07 by an unrelated third party before patches were ready, Hyunwoo Kim and the affected maintainers published the full write-up and PoC at https://github.com/V4bel/dirtyfrag with maintainer agreement; as of 2026-05-08 no CVE has been assigned and no upstream patch has shipped.
Impact for defenders: every multi-user Linux host (university clusters, jump hosts, shared CI runners, container hosts), every Linux container with a shared host kernel (Docker, containerd, Kubernetes nodes — the bug yields container-to-host root on hosts where the container can create user namespaces), and every Linux endpoint with a logged-in unprivileged attacker is at immediate risk. Recommended interim mitigation is to denylist the esp4, esp6, and rxrpc modules via /etc/modprobe.d/dirtyfrag.conf and rmmod the running modules; this breaks IPsec VPN termination and AFS/RxRPC clients, but the trade-off is justified for any system without a hard requirement on those subsystems.
MITRE ATT&CK techniques used in TL-2026-0483
Credential Access
T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow; T1556.003 Modify Authentication Process: Pluggable Authentication Modules
Defense Evasion
T1006 Direct Volume Access; T1070.004 Indicator Removal: File Deletion; T1211 Exploitation for Stealth
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1611 Escape to Host
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Persistence
defense-impairment
T1222.002 Linux and Mac Permissions; T1601.001 Modify System Image: Patch System Image
Impact
T1565.001 Data Manipulation: Stored Data Manipulation
stealth
Resource Development
T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits
Affected products and versions in Linux Kernel 'Dirty Frag' Universal Local Privilege
- Linux Kernel — Linux Kernel (xfrm-ESP)
Vulnerable versions: >= 4.11 (commit cac2661c53f3, 2017-01-17) - Linux Kernel — Linux Kernel (RxRPC)
Vulnerable versions: >= 6.5 (commit 2dc334f1a63a, June 2023) - Canonical — Ubuntu
Vulnerable versions: 20.04 LTS; 22.04 LTS; 24.04 LTS; 25.10 - Debian — Debian GNU/Linux
Vulnerable versions: 11 bullseye; 12 bookworm; 13 trixie - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: 8; 9; 10 - Red Hat — CentOS Stream
Vulnerable versions: 9; 10 - AlmaLinux Foundation — AlmaLinux
Vulnerable versions: 8; 9; 10 - SUSE — openSUSE Tumbleweed
Vulnerable versions: rolling - Fedora Project — Fedora
Vulnerable versions: 41; 42; 43 - Arch Linux — Arch Linux
Vulnerable versions: rolling
Remediation for Linux Kernel 'Dirty Frag' Universal Local Privilege
Immediate actions
- Denylist the esp4, esp6, and rxrpc kernel modules: printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf && rmmod esp4 esp6 rxrpc 2>/dev/null
- Disable unprivileged user namespaces on hosts that do not need them: sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or set user.max_user_namespaces=0 (RHEL family) — closes the xfrm-ESP sub-primitive
- Remove CAP_NET_ADMIN from user-namespace capability bounding sets where supported, or run sensitive workloads under SELinux/AppArmor profiles that deny unshare(CLONE_NEWUSER) and AF_RXRPC socket creation
- Block AF_RXRPC socket creation via seccomp or LSM where the workload does not require it
- Hunt for the indicators in the IOC list (V4bel/dirtyfrag binary, suspicious /etc/passwd or /usr/bin/su page-cache divergence) on every Linux host
Workarounds
- Module denylist (esp4, esp6, rxrpc) via /etc/modprobe.d/dirtyfrag.conf — breaks IPsec VPN termination, AFS, and RxRPC clients
- Disable unprivileged user namespaces — neutralises xfrm-ESP primitive but not RxRPC primitive
- Reboot after rmmod to clear any in-flight exploit state in page cache
Longer-term hardening
- Apply upstream kernel patches as soon as they ship from kernel.org and the distribution security teams (no patch available as of 2026-05-08)
- Subscribe affected hosts to the distribution security advisories: USN (Ubuntu), DSA (Debian), RHSA (Red Hat), SUSE-SU, FEDORA-2026, ASA (Arch)
- Deploy EDR with kernel runtime integrity monitoring that compares page-cache contents of critical files (/etc/passwd, /etc/shadow, /usr/bin/su, /usr/bin/sudo, /usr/bin/passwd) against on-disk hashes
- Adopt least-privilege container runtime profiles that strip CAP_NET_ADMIN, deny user-namespace creation, and seccomp-block AF_RXRPC and xfrm Netlink (NETLINK_XFRM) socket families
- Migrate sensitive workloads onto microVM isolation (Firecracker, Kata Containers, gVisor) where a host kernel LPE does not yield container escape
Weaknesses (CWE) in Linux Kernel 'Dirty Frag' Universal Local Privilege
CWE-787, CWE-362, CWE-269, CWE-668, CWE-119
Timeline of Linux Kernel 'Dirty Frag' Universal Local Privilege
- Vulnerable xfrm-ESP code path introduced into the Linux mainline kernel via commit cac2661c53f3, shipping in kernel 4.11 and every subsequent release. The change wired splice()-supplied page references through the ESP receive-side AEAD transform without exclusivity checks, planting the dormant page-cache write primitive that would later be weaponised as the first half of Dirty Frag.
- Vulnerable RxRPC zero-copy send fast-path introduced via commit 2dc334f1a63a in Linux 6.5; the change accepted splice()-supplied page-cache page references into rxkad_secure_packet() in-place encryption without verifying page exclusivity, planting the second Dirty Frag primitive.
- Hyunwoo Kim (@v4bel) of Theori privately identifies the xfrm-ESP and RxRPC page-cache write primitives, weaponises them into a deterministic chained LPE, and notifies the Linux kernel security team and affected maintainers under coordinated disclosure.
- Kernel networking maintainers post the proposed xfrm-ESP fix as commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4 to the netdev/net.git tree; not yet merged to mainline as of 2026-05-08. RxRPC fix still under discussion.
- With maintainer agreement, Hyunwoo Kim publishes the full Dirty Frag write-up and a complete, weaponised PoC at https://github.com/V4bel/dirtyfrag and on the oss-security mailing list (https://www.openwall.com/lists/oss-security/2026/05/07/8). RxRPC report posted to lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/.
- An unrelated third party publishes details of one of the underlying primitives prior to the agreed coordinated disclosure date, breaking the embargo before any patch is ready or any CVE is allocated.
- Threadlinqs Intelligence publishes TL-2026-0483 with full MITRE mapping, IOC list, simulation atomics, and detection coverage (Splunk SPL, Microsoft KQL, Sigma) for the Dirty Frag exploitation chain and its mitigation triggers.
- NSFOCUS, SANS Internet Storm Center, and BleepingComputer publish coordinated alert articles on the same day, prioritising Dirty Frag for every Linux operator. No distribution kernel updates are available; affected vendors point operators to the modprobe denylist workaround for esp4, esp6, and rxrpc.
- As of 2026-05-29, Dirty Frag remains an active live concern: it now carries CVE-2026-43284 (xfrm-ESP) and CVE-2026-43500 (RxRPC), Microsoft Defender confirmed limited in-the-wild exploitation via su/SSH, and CISA reportedly added it to KEV. Mainline and distro patches (Ubuntu, RHEL, AlmaLinux, CloudLinux) are shipping but fleet rollout is incomplete, with the weaponized PoC public and a successor variant (Fragnesia, CVE-2026-46300) emerging.
Sources cited for Linux Kernel 'Dirty Frag' Universal Local Privilege
- NSFOCUS — Linux Kernel Privilege Escalation Vulnerability (Dirty Frag) Alert
- SANS ISC — Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag
- BleepingComputer — New Linux 'Dirty Frag' zero-day with PoC exploit gives root privileges
- Openwall oss-security — Dirty Frag disclosure (Hyunwoo Kim)
- V4bel/dirtyfrag — Public PoC repository (full exploit + write-up)
- Dirty Frag technical site (researcher)
- lore.kernel.org — RxRPC page-cache write report (afKV2zGR6rrelPC7@v4bel)
- Linux netdev — proposed xfrm-ESP fix commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4
- Linux mainline — vulnerable xfrm-ESP commit cac2661c53f3 (introduced 2017-01-17)
- Linux mainline — vulnerable RxRPC commit 2dc334f1a63a (introduced June 2023)
- MITRE ATT&CK — T1068 Exploitation for Privilege Escalation
- MITRE ATT&CK — T1611 Escape to Host
- Dirty Pipe (CVE-2022-0847) — same vulnerability class baseline
Threats related to Linux Kernel 'Dirty Frag' Universal Local Privilege
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions
- Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruption
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- DirtyClone Linux Kernel Local Privilege Escalation via __pskb_copy_fclone() (CVE-2026-43503)
- Linux Kernel FUSE Page-Cache Buffer Overflow (CVE-2026-31694) Enables Local Privilege Escalation
- DirtyClone (CVE-2026-43503): Linux Kernel Packet-Cloning Page-Cache Write Enables Local Privilege Escalation to Root via IPsec ESP
Detection coverage for TL-2026-0483
As of 2026-05-08, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0483 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.