# Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC)

> Dirty Frag is a universal Linux kernel local privilege escalation that chains two independent page-cache write primitives in the xfrm-ESP (esp4/esp6) IPsec module and the RxRPC module to overwrite the in-memory page cache of read-only files such as /etc/passwd and /usr/bin/su, granting root on every major distribution. Discovered by Hyunwoo Kim (@v4bel) of Theori, the bug is deterministic, requires no race window, leaves disk content untouched, and a complete weaponised PoC (V4bel/dirtyfrag) was published 2026-05-07 after the coordinated-disclosure embargo was prematurely broken. As of 2026-05-08 there is no CVE assignment and no upstream kernel patch is available, leaving every Linux multi-tenant host, container host, jump server, and CI runner exposed.

- **Published:** 2026-05-08T12:00:00Z
- **Last reviewed:** 2026-05-08T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0483
- **ID:** TL-2026-0483
- **Severity:** CRITICAL (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Dirty Frag is a universal Linux kernel local privilege escalation (LPE) discovered by kernel security researcher Hyunwoo Kim (Twitter handle @v4bel) of Theori. The vulnerability chains two independent but structurally-identical page-cache corruption primitives that reside in kernel cryptographic fast-paths performing in-place AEAD operations on splice()-supplied page references without verifying that the referenced page-cache page is exclusively owned by the caller. The two sub-vulnerabilities are: (1) the xfrm-ESP Page-Cache Write, residing in the IPsec ESP receive-side decryption fast-paths in net/ipv4/esp4.c and net/ipv6/esp6.c, introduced by commit cac2661c53f3 on 2017-01-17 (kernel >= 4.11); and (2) the RxRPC Page-Cache Write, residing in the RxRPC RxKAD encryption send-side fast-path, introduced by commit 2dc334f1a63a in June 2023 (kernel >= 6.5).

In both cases an unprivileged local attacker uses splice() to plant a reference to a read-only page-cache page (for example, the kernel-cached page backing /etc/passwd or /usr/bin/su) into an skb fragment slot. The kernel ESP / RxKAD path then invokes its in-place AEAD transform, which iterates through the skb fragments and encrypts/decrypts each page in-place — silently mutating the underlying page-cache page. Because Linux serves subsequent reads of those files from the cached page until the page is evicted, the attacker has effectively rewritten /etc/passwd or /usr/bin/su for every process on the system without ever modifying the on-disk file. Each primitive yields a 4-byte attacker-controlled write per invocation; the public PoC chains many invocations to either (a) overwrite approximately 192 bytes at offset 0 of /usr/bin/su's page cache with a minimal x86_64 ELF shellcode whose entry point lives at 0x78, then triggers su to execute as root, or (b) blank the password hash field of root in /etc/passwd to exploit PAM's nullok behaviour and obtain root via a normal su.

The xfrm-ESP path requires CAP_NET_ADMIN inside a user namespace, which is available to ordinary users on every major desktop and server distribution that ships kernel.unprivileged_userns_clone=1 (Ubuntu, Debian, Fedora, Arch, openSUSE Tumbleweed, recent RHEL/AlmaLinux/CentOS Stream). The exploit uses setup_userns_netns() to enter a fresh user+net namespace, add_xfrm_sa() to install a Security Association via the xfrm_user Netlink interface, then crafts an ESP packet whose payload references an attacker-staged page-cache page; the receiver-side esp_input() drops the encrypted plaintext directly back into the page-cache page. The RxRPC path is even less restricted: it requires only the ability to create an AF_RXRPC socket (no CAP_NET_ADMIN, no namespacing) and uses rxrpc_client_initiate_call() to start an RxKAD-encrypted call whose zero-copy send buffer carries a splice()-planted page-cache page reference, which the rxkad_secure_packet() transform corrupts in-place via fcrypt_user_decrypt().

Dirty Frag is the third member of a three-bug family (Dirty Pipe — CVE-2022-0847, Copy Fail — CVE-2026-31431 in the algif_aead/AF_ALG interface, and now Dirty Frag) sharing the same root pattern: a kernel subsystem performing in-place writes on pages obtained via splice() without honouring the page's read-only intent. The bug is deterministic (no race condition, no panic-on-failure), has very high reliability on every tested kernel, leaves no on-disk artefact, and bypasses every disk-scanning EDR. Because the disclosure embargo was broken on 2026-05-07 by an unrelated third party before patches were ready, Hyunwoo Kim and the affected maintainers published the full write-up and PoC at https://github.com/V4bel/dirtyfrag with maintainer agreement; as of 2026-05-08 no CVE has been assigned and no upstream patch has shipped.

Impact for defenders: every multi-user Linux host (university clusters, jump hosts, shared CI runners, container hosts), every Linux container with a shared host kernel (Docker, containerd, Kubernetes nodes — the bug yields container-to-host root on hosts where the container can create user namespaces), and every Linux endpoint with a logged-in unprivileged attacker is at immediate risk. Recommended interim mitigation is to denylist the esp4, esp6, and rxrpc modules via /etc/modprobe.d/dirtyfrag.conf and rmmod the running modules; this breaks IPsec VPN termination and AFS/RxRPC clients, but the trade-off is justified for any system without a hard requirement on those subsystems.

## MITRE ATT&CK

- T1068 Exploitation for Privilege Escalation
- T1611 Escape to Host
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1211 Exploitation for Stealth
- T1222.002 Linux and Mac Permissions
- T1070.004 Indicator Removal: File Deletion
- T1006 Direct Volume Access
- T1601.001 Modify System Image: Patch System Image
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
- T1556.003 Modify Authentication Process: Pluggable Authentication Modules
- T1098 Account Manipulation
- T1574 Hijack Execution Flow
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1565.001 Data Manipulation: Stored Data Manipulation
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits

## Sources

- [NSFOCUS — Linux Kernel Privilege Escalation Vulnerability (Dirty Frag) Alert](https://nsfocusglobal.com/linux-kernel-privilege-escalation-vulnerability-dirty-frag-alert/)
- [SANS ISC — Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag](https://isc.sans.edu/diary/rss/32968)
- [BleepingComputer — New Linux 'Dirty Frag' zero-day with PoC exploit gives root privileges](https://www.bleepingcomputer.com/news/security/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges/)
- [Openwall oss-security — Dirty Frag disclosure (Hyunwoo Kim)](https://www.openwall.com/lists/oss-security/2026/05/07/8)
- [V4bel/dirtyfrag — Public PoC repository (full exploit + write-up)](https://github.com/V4bel/dirtyfrag)
- [Dirty Frag technical site (researcher)](https://dirtyfrag.io/)
- [lore.kernel.org — RxRPC page-cache write report (afKV2zGR6rrelPC7@v4bel)](https://lore.kernel.org/all/afKV2zGR6rrelPC7@v4bel/)
- [Linux netdev — proposed xfrm-ESP fix commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4](https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4)
- [Linux mainline — vulnerable xfrm-ESP commit cac2661c53f3 (introduced 2017-01-17)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cac2661c53f3)
- [Linux mainline — vulnerable RxRPC commit 2dc334f1a63a (introduced June 2023)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=2dc334f1a63a)
- [MITRE ATT&CK — T1068 Exploitation for Privilege Escalation](https://attack.mitre.org/techniques/T1068/)
- [MITRE ATT&CK — T1611 Escape to Host](https://attack.mitre.org/techniques/T1611/)
- [Dirty Pipe (CVE-2022-0847) — same vulnerability class baseline](https://dirtypipe.cm4all.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0483