# Linux Kernel LPE Surge: Copy Fail (CVE-2026-31431), Dirty Frag/Fragnesia (CVE-2026-43284/CVE-2026-43500/CVE-2026-46300), and CrackArmor AppArmor Flaws vs. Defense-in-Depth Mitigations

> Three independent, deterministic Linux kernel local-privilege-escalation chains surfaced within months of each other in 2026: Copy Fail (CVE-2026-31431) abusing the AF_ALG algif_aead crypto interface, Dirty Frag/Fragnesia (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) chaining esp4/esp6 IPSec and AF_RXRPC page-cache-write bugs, and CrackArmor, nine confused-deputy and memory-safety bugs in the AppArmor LSM exploited against /sys/kernel/security/apparmor/ pseudo-files via su/sudo. All three grant root without race conditions and have public PoC exploits; Microsoft has observed limited in-the-wild exploitation.

- **Published:** 2026-05-29T00:00:00Z
- **Last reviewed:** 2026-05-29T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2424
- **ID:** TL-2026-2424
- **Severity:** HIGH (CVSS 7.8)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-46300, CVE-2026-23268, CVE-2026-23269, CVE-2026-23403, CVE-2026-23404, CVE-2026-23405, CVE-2026-23406, CVE-2026-23407, CVE-2026-23408, CVE-2026-23409, CVE-2026-23410, CVE-2026-23411

## Description

In 2026 three unrelated Linux kernel subsystems produced reliable, PoC-public local-privilege-escalation (LPE) primitives that a single unprivileged local user can chain to root.

Copy Fail (CVE-2026-31431, CVSS 3.1 7.8) is a logic flaw in the algif_aead AEAD cipher interface of the kernel's userspace crypto API (AF_ALG). A 2017 in-place-processing optimization (commit 72548b093ee3) allowed page-cache pages to be placed into a writable destination scatterlist. An attacker creates an AF_ALG SEQPACKET socket bound to an AEAD algorithm such as authencesn(hmac(sha256),cbc(aes)), uses splice() to feed a setuid binary's (typically /usr/bin/su) page-cache pages into the crypto pipeline, then issues recvmsg() with crafted associated-data (AAD) bytes to perform a controlled 4-byte write into the spliced file's cached pages, corrupting the binary and bypassing normal file permissions. Unlike race-condition LPEs such as Dirty Pipe (CVE-2022-0847), Copy Fail is deterministic and works unmodified across distributions via a ~732-byte Python PoC. Practically every mainline kernel built 2017-2026 was vulnerable until the upstream fix (commit a664bf3d603d, reverting the 2017 optimization) landed in 7.0/6.19.12/6.18.22 and LTS backports. CISA added it to the KEV catalog on 2026-05-01.

Dirty Frag is a vulnerability class chaining two independently rooted page-cache-write primitives: an xfrm-ESP (esp4/esp6 IPSec) bug (CVE-2026-43284, root cause introduced January 2017) and an AF_RXRPC (AFS distributed-filesystem protocol) bug (CVE-2026-43500, root cause introduced June 2023). When the receive path decrypts over paged buffers not privately owned by the kernel (e.g., pipe pages reaching the socket via splice(2)/sendfile(2)), an unprivileged process can retain references to the resulting plaintext, yielding a write primitive into the page cache that, like Copy Fail, can be aimed at a setuid binary for root. Independent researcher Hyunwoo Kim (@v4bel) reported it to kernel maintainers 2026-04-30; public disclosure followed 2026-05-07 after an embargo break, with patches released 2026-05-11. A third variant, Fragnesia (CVE-2026-46300), using skb coalescing via ESP-in-TCP, was found 2026-05-14 and folded into the same Dirty Frag vulnerability set per Red Hat's RHSB-2026-003. Microsoft Defender documented limited in-the-wild exploitation: SSH access, interactive shell spawning, staging/execution of an ELF binary named "./update", modification of a compromised GLPI deployment's LDAP authentication files via vim, and PHP session-file manipulation to both disrupt and read active web sessions.

CrackArmor is a set of nine vulnerabilities in the AppArmor Linux Security Module discovered by the Qualys Threat Research Unit, present since AppArmor v4.11 (2017) and affecting Ubuntu, Debian, and SUSE (Android and Red Hat/SELinux-based distros are unaffected). The primary issue is a confused-deputy problem: the pseudo-files /sys/kernel/security/apparmor/.load, .replace, and .remove are world-writable (mode 0666). An unprivileged user opens one of these files O_WRONLY, then executes a privileged program such as su with stdout/stderr redirected into it; the privileged program's own output is interpreted as an AppArmor policy load, letting the attacker install arbitrary profiles without ever holding write permission on the policy interface directly. A demonstrated escalation loads a profile that denies CAP_SETUID to sudo; when sudo then fails to drop privileges before invoking sendmail with an attacker-controlled MAIL_CONFIG, Postfix executes attacker commands as root. Eight further kernel-space memory-safety bugs (uncontrolled recursion causing stack exhaustion in __remove_profile(), an 8KB-kmalloc out-of-bounds read enabling up to 64KB disclosure, a use-after-free in the kmalloc-192 slab, a double-free across kmalloc-8 through kmalloc-256, DFA state bounds violations, memory leaks in profile verification, and race conditions on rawdata dereferencing) round out the set, and a "userns" profile bypass allows unprivileged user-namespace creation with full capabilities, undermining distro-level namespace restrictions and enabling container escape. Eleven patches were published upstream 2026-03-12.

The Synacktiv source article ties all three together to argue that, notwithstanding fast-following patches, host-level defense-in-depth (setuid-binary permission hardening via dpkg-statoverride, kernel.modules_disabled sysctl allow-listing, eBPF-LSM socket-bind gating, and seccomp/container profile restriction of AF_ALG/esp4/esp6/rxrpc) meaningfully narrows the window of exposure before patches land fleet-wide.

## MITRE ATT&CK

- T1021.004 SSH
- T1059.004 Unix Shell
- T1059.006 Python
- T1556 Modify Authentication Process
- T1548.001 Setuid and Setgid
- T1685 Disable or Modify Tools
- T1611 Escape to Host
- T1539 Steal Web Session Cookie

## Sources

- [Surviving the surge of new Linux LPE: Defense in Depth not dead](https://www.synacktiv.com/en/publications/surviving-the-surge-of-new-linux-lpe-defense-in-depth-not-dead.html)
- [CrackArmor: Critical AppArmor Flaws Enable Local Privilege Escalation to Root](https://blog.qualys.com/vulnerabilities-threat-research/2026/03/12/crackarmor-critical-apparmor-flaws-enable-local-privilege-escalation-to-root)
- [Qualys Security Advisory CrackArmor: Multiple vulnerabilities in AppArmor](https://cdn2.qualys.com/advisory/2026/03/10/crack-armor.txt)
- [CVE-2026-31431: "Copy Fail" Linux kernel flaw lets local users gain root in seconds](https://www.sysdig.com/blog/cve-2026-31431-copy-fail-linux-kernel-flaw-lets-local-users-gain-root-in-seconds)
- [Copy Fail: What You Need to Know About the Most Severe Linux Threat in Years](https://unit42.paloaltonetworks.com/cve-2026-31431-copy-fail/)
- [How Cloudflare responded to the "Copy Fail" Linux vulnerability](https://blog.cloudflare.com/copy-fail-linux-vulnerability-mitigation/)
- [Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions](https://thehackernews.com/2026/05/linux-kernel-dirty-frag-lpe-exploit.html)
- [Active attack: Dirty Frag Linux vulnerability expands post-compromise risk](https://www.microsoft.com/en-us/security/blog/2026/05/08/active-attack-dirty-frag-linux-vulnerability-expands-post-compromise-risk/)
- [RHSB-2026-003 Networking subsystem Privilege Escalation - Linux Kernel (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) - "Dirty Frag"](https://access.redhat.com/security/vulnerabilities/RHSB-2026-003)
- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/05/01/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2026-31431 Record](https://www.cve.org/CVERecord?id=CVE-2026-31431)
- [copy-fail-CVE-2026-31431 (proof-of-concept exploit)](https://github.com/theori-io/copy-fail-CVE-2026-31431)
- [dirtyfrag (proof-of-concept exploit)](https://github.com/V4bel/dirtyfrag/)
- [Fixes available for CVE-2026-31431 (Copy Fail) Linux Kernel Local Privilege Escalation Vulnerability](https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available)
- [Nine critical vulnerabilities in Linux AppArmor put over 12M enterprise systems at risk](https://www.csoonline.com/article/4145539/nine-critical-vulnerabilities-in-linux-apparmor-put-over-12m-enterprise-systems-at-risk.html)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2424