Linux Kernel LPE Surge: Copy Fail (CVE-2026-31431), Dirty Frag/Fragnesia (CVE-2026-43284/CVE-2026-43500/CVE-2026-46300), and CrackArmor AppArmor Flaws vs. Defense-in-Depth Mitigations
Linux Kernel LPE Surge (TL-2026-2424), also tracked as Copy Fail, is a high-severity software vulnerability scored CVSS 7.8, first published 2026-05-29. It has no confirmed attribution, affects Linux Kernel (kernel.org) Linux Kernel, references 15 CVEs (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500), maps to 8 MITRE ATT&CK techniques (T1021.004, T1059.004, T1059.006), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-2424
- Threat ID
- TL-2026-2424
- Also known as
- Copy Fail, Dirty Frag, Fragnesia, CrackArmor
- Severity
- HIGH
- CVSS
- 7.8 (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- 2026-05-29
- Last reviewed
- 2026-05-29
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- government administration, cloudinfrastructure, enterpriseit, technology
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in Linux Kernel LPE Surge
Malware and tooling: DirtyFrag, Fragnesia, Falco, Microsoft Defender for Endpoint, Sysdig Secure
Three independent, deterministic Linux kernel local-privilege-escalation chains surfaced within months of each other in 2026: Copy Fail (CVE-2026-31431) abusing the AF_ALG algif_aead crypto interface, Dirty Frag/Fragnesia (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) chaining esp4/esp6 IPSec and AF_RXRPC page-cache-write bugs, and CrackArmor, nine confused-deputy and memory-safety bugs in the AppArmor LSM exploited against /sys/kernel/security/apparmor/ pseudo-files via su/sudo. All three grant root without race conditions and have public PoC exploits; Microsoft has observed limited in-the-wild exploitation.
How Linux Kernel LPE Surge works
In 2026 three unrelated Linux kernel subsystems produced reliable, PoC-public local-privilege-escalation (LPE) primitives that a single unprivileged local user can chain to root.
Copy Fail (CVE-2026-31431, CVSS 3.1 7.8) is a logic flaw in the algif_aead AEAD cipher interface of the kernel's userspace crypto API (AF_ALG). A 2017 in-place-processing optimization (commit 72548b093ee3) allowed page-cache pages to be placed into a writable destination scatterlist. An attacker creates an AF_ALG SEQPACKET socket bound to an AEAD algorithm such as authencesn(hmac(sha256),cbc(aes)), uses splice() to feed a setuid binary's (typically /usr/bin/su) page-cache pages into the crypto pipeline, then issues recvmsg() with crafted associated-data (AAD) bytes to perform a controlled 4-byte write into the spliced file's cached pages, corrupting the binary and bypassing normal file permissions. Unlike race-condition LPEs such as Dirty Pipe (CVE-2022-0847), Copy Fail is deterministic and works unmodified across distributions via a ~732-byte Python PoC. Practically every mainline kernel built 2017-2026 was vulnerable until the upstream fix (commit a664bf3d603d, reverting the 2017 optimization) landed in 7.0/6.19.12/6.18.22 and LTS backports. CISA added it to the KEV catalog on 2026-05-01.
Dirty Frag is a vulnerability class chaining two independently rooted page-cache-write primitives: an xfrm-ESP (esp4/esp6 IPSec) bug (CVE-2026-43284, root cause introduced January 2017) and an AF_RXRPC (AFS distributed-filesystem protocol) bug (CVE-2026-43500, root cause introduced June 2023). When the receive path decrypts over paged buffers not privately owned by the kernel (e.g., pipe pages reaching the socket via splice(2)/sendfile(2)), an unprivileged process can retain references to the resulting plaintext, yielding a write primitive into the page cache that, like Copy Fail, can be aimed at a setuid binary for root. Independent researcher Hyunwoo Kim (@v4bel) reported it to kernel maintainers 2026-04-30; public disclosure followed 2026-05-07 after an embargo break, with patches released 2026-05-11. A third variant, Fragnesia (CVE-2026-46300), using skb coalescing via ESP-in-TCP, was found 2026-05-14 and folded into the same Dirty Frag vulnerability set per Red Hat's RHSB-2026-003. Microsoft Defender documented limited in-the-wild exploitation: SSH access, interactive shell spawning, staging/execution of an ELF binary named "./update", modification of a compromised GLPI deployment's LDAP authentication files via vim, and PHP session-file manipulation to both disrupt and read active web sessions.
CrackArmor is a set of nine vulnerabilities in the AppArmor Linux Security Module discovered by the Qualys Threat Research Unit, present since AppArmor v4.11 (2017) and affecting Ubuntu, Debian, and SUSE (Android and Red Hat/SELinux-based distros are unaffected). The primary issue is a confused-deputy problem: the pseudo-files /sys/kernel/security/apparmor/.load, .replace, and .remove are world-writable (mode 0666). An unprivileged user opens one of these files O_WRONLY, then executes a privileged program such as su with stdout/stderr redirected into it; the privileged program's own output is interpreted as an AppArmor policy load, letting the attacker install arbitrary profiles without ever holding write permission on the policy interface directly. A demonstrated escalation loads a profile that denies CAP_SETUID to sudo; when sudo then fails to drop privileges before invoking sendmail with an attacker-controlled MAIL_CONFIG, Postfix executes attacker commands as root. Eight further kernel-space memory-safety bugs (uncontrolled recursion causing stack exhaustion in __remove_profile(), an 8KB-kmalloc out-of-bounds read enabling up to 64KB disclosure, a use-after-free in the kmalloc-192 slab, a double-free across kmalloc-8 through kmalloc-256, DFA state bounds violations, memory leaks in profile verification, and race conditions on rawdata dereferencing) round out the set, and a "userns" profile bypass allows unprivileged user-namespace creation with full capabilities, undermining distro-level namespace restrictions and enabling container escape. Eleven patches were published upstream 2026-03-12.
The Synacktiv source article ties all three together to argue that, notwithstanding fast-following patches, host-level defense-in-depth (setuid-binary permission hardening via dpkg-statoverride, kernel.modules_disabled sysctl allow-listing, eBPF-LSM socket-bind gating, and seccomp/container profile restriction of AF_ALG/esp4/esp6/rxrpc) meaningfully narrows the window of exposure before patches land fleet-wide.
MITRE ATT&CK techniques used in TL-2026-2424
lateral-movement
Execution
T1059.004 Unix Shell; T1059.006 Python
Credential Access
T1539 Steal Web Session Cookie
Privilege Escalation
Persistence
T1556 Modify Authentication Process
privilege-escalation
defense-impairment
Affected products and versions in Linux Kernel LPE Surge
- Linux Kernel (kernel.org) — Linux Kernel
Vulnerable versions: 4.14 through 7.0-rc; 6.18.x before 6.18.22; 6.19.x before 6.19.12
Fixed in: 7.0; 6.19.12; 6.18.22; 6.12.x LTS backport; 6.6.x LTS backport; 5.15.x LTS backport; 5.10.x LTS backport - Canonical — Ubuntu
Vulnerable versions: 24.04 LTS; 24.04.3; 24.04.4
Fixed in: patched kernel per Ubuntu Security Notice - Red Hat — Red Hat Enterprise Linux (incl. OpenShift, OpenStack, Virtualization)
Vulnerable versions: RHEL 8; RHEL 9; RHEL 10; RHEL 10.1
Fixed in: patched kernel per RHSA (CVE-2026-43500 does not affect Red Hat products) - SUSE — SUSE Linux Enterprise / openSUSE
Vulnerable versions: SUSE 16; openSUSE Tumbleweed
Fixed in: patched kernel per SUSE advisory - AlmaLinux OS Foundation — AlmaLinux
Vulnerable versions: AlmaLinux 10
Fixed in: patched kernel per AlmaLinux errata - Amazon Web Services — Amazon Linux
Vulnerable versions: Amazon Linux 2023
Fixed in: patched kernel per AWS advisory - Fedora Project — Fedora
Vulnerable versions: Fedora 44
Fixed in: patched kernel per Fedora update - CentOS — CentOS Stream
Vulnerable versions: CentOS Stream 10
Fixed in: patched kernel per CentOS build - Canonical / Debian / SUSE (AppArmor upstream) — AppArmor Linux Security Module
Vulnerable versions: v4.11 (2017) through pre-2026-03-12 releases
Fixed in: 11-patch series published upstream 2026-03-12
Remediation for Linux Kernel LPE Surge
Patches
- Linux kernel commit a664bf3d603d (mainline fix reverting the algif_aead in-place optimization for CVE-2026-31431)
- Dirty Frag/Fragnesia kernel patches for esp4/esp6 and rxrpc (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300), released 2026-05-11
- CrackArmor 11-patch series for the AppArmor LSM, published upstream 2026-03-12
Immediate actions
- Patch to fixed kernel builds (7.0, 6.19.12, 6.18.22, or vendor LTS backports to 6.12.x/6.6.x/5.15.x/5.10.x) that revert the algif_aead in-place optimization behind Copy Fail (CVE-2026-31431)
- Apply Dirty Frag kernel patches released 2026-05-11 addressing esp4/esp6 (CVE-2026-43284), rxrpc (CVE-2026-43500), and the Fragnesia ESP-in-TCP variant (CVE-2026-46300)
- Apply the upstream AppArmor CrackArmor 11-patch series (published 2026-03-12) or the corresponding vendor kernel/apparmor package updates
- Tighten permissions on su and sudo setuid binaries (rwsr-x--- restricted to an admins group) via dpkg-statoverride to blunt confused-deputy and page-cache-write LPE targeting of these binaries
Workarounds
- Disable CONFIG_CRYPTO_USER_API_AEAD if userspace AEAD crypto sockets are not needed, to blunt Copy Fail
- Block esp4/esp6 kernel modules via modprobe blacklist on hosts that do not use IPSec, to blunt Dirty Frag
- Disable unprivileged user-namespace creation to preserve IPSec/AFS functionality while closing off part of the confused-deputy and namespace-bypass exploitation path
Longer-term hardening
- Deploy eBPF-LSM, Falco, or Sysdig Secure runtime rules to detect anomalous AF_ALG socket creation and algif_aead usage outside an allow-list of legitimate binaries
- Lock kernel.modules_disabled via sysctl after boot-time module load to prevent loading of unnecessary crypto/IPSec/AFS kernel modules
- Restrict AF_ALG, esp4/esp6, and rxrpc module availability via seccomp or container security profiles for workloads that do not require them
- Disable unprivileged user namespaces where not operationally required to reduce both the CrackArmor confused-deputy blast radius and container-escape risk
CVEs associated with Linux Kernel LPE Surge
- CVE-2026-31431
- CVE-2026-43284
- CVE-2026-43500
CVE-2026-46300CVE-2026-23268CVE-2026-23269CVE-2026-23403CVE-2026-23404CVE-2026-23405CVE-2026-23406CVE-2026-23407CVE-2026-23408CVE-2026-23409CVE-2026-23410CVE-2026-23411
Weaknesses (CWE) in Linux Kernel LPE Surge
CWE-669, CWE-1288
Timeline of Linux Kernel LPE Surge
- The xfrm-ESP (esp4/esp6) page-cache-write root cause behind Dirty Frag (CVE-2026-43284) is introduced in the kernel
- AppArmor's confused-deputy design flaw (world-writable .load/.replace/.remove pseudo-files) is present starting with AppArmor v4.11, later dubbed CrackArmor by Qualys
- Kernel commit 72548b093ee3 introduces the algif_aead in-place processing optimization that becomes the root cause of Copy Fail (CVE-2026-31431)
- The AF_RXRPC page-cache-write root cause behind Dirty Frag (CVE-2026-43500) is introduced in the kernel
- Qualys Threat Research Unit publishes the CrackArmor security advisory detailing nine AppArmor LSM vulnerabilities
- Eleven upstream patches for the CrackArmor AppArmor vulnerabilities are published in Linus's tree
- CVE-2026-31431 (Copy Fail) is publicly disclosed at 16:00 UTC; Cloudflare's behavioral detection validates against the exploit within hours
- Cloudflare declares a security incident, begins threat hunting, and deploys an eBPF-LSM mitigation fleet-wide for Copy Fail
- CISA adds CVE-2026-31431 to the Known Exploited Vulnerabilities catalog
- Dirty Frag (CVE-2026-43284 / CVE-2026-43500) is publicly disclosed following an embargo break by a third-party publication
- Microsoft publishes reporting on limited in-the-wild Dirty Frag exploitation, including SSH-based access, ELF staging, and GLPI LDAP/session tampering
- Upstream Dirty Frag patches are released for esp4/esp6 (CVE-2026-43284) and rxrpc (CVE-2026-43500)
- The Fragnesia variant (CVE-2026-46300), using skb coalescing via ESP-in-TCP, is discovered as a third member of the Dirty Frag vulnerability set
- Synacktiv publishes "Surviving the surge of new Linux LPE: Defense in Depth not dead," synthesizing Copy Fail, Dirty Frag, and CrackArmor with defense-in-depth mitigation guidance
Sources cited for Linux Kernel LPE Surge
- Surviving the surge of new Linux LPE: Defense in Depth not dead
- CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root
- Qualys Security Advisory CrackArmor: Multiple vulnerabilities in AppArmor
- CVE-2026-31431: "Copy Fail" Linux kernel flaw lets local users gain root in seconds
- Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years
- How Cloudflare responded to the "Copy Fail" Linux vulnerability
- Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
- Active attack: Dirty Frag Linux vulnerability expands post-compromise risk
- RHSB-2026-003 Networking subsystem Privilege Escalation - Linux Kernel (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) - "Dirty Frag"
- CISA Adds One Known Exploited Vulnerability to Catalog
- CVE-2026-31431 Record
- copy-fail-CVE-2026-31431 (proof-of-concept exploit)
- dirtyfrag (proof-of-concept exploit)
- Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability
- Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk
More in vulnerability
- VLC Media Player: Integer Overflow in AllocatePicture (CVE-2026-56711) and RTSP Heap Out-of-Bounds Read (CVE-2026-73324)
- Dutch NCSC Warns of Critical Check Point VPN Flaws (CVE-2026-85102, CVE-2026-85103) — Exploitation Expected Imminently
- GitLab Patches Max-Severity Unauthenticated Path Traversal Flaw in Repository Commits API (CVE-2026-85706, CVSS 10.0)
- CVE-2026-0310: PAN-OS XML Processing Out-of-Bounds Write Enables Unauthenticated Root RCE
- Endor Labs Discloses 14 Critical/High Vulnerabilities Across Seven AI Orchestration Platforms (NocoBase, Flowise, Langflow, Dify, Activepieces, Kestra, Apache Airflow)
Detection coverage for TL-2026-2424
As of 2026-05-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2424 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.