Dirty Frag is a Linux kernel local privilege escalation vulnerability discovered by Hyunwoo Kim. It exploits two chained sub-vulnerabilities: xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write. Both vulnerabilities arise from zero-copy send paths where splice() references a read-only page cache page in the sender-side skb frag slot, and the receiver-side kernel performs in-place cryptographic operations on that page. This modifies the page cache of files that an unprivileged user can read, causing subsequent reads to see the modified content. Unlike the related Copy Fail vulnerability (CVE-2026-31431), Dirty Frag requires chaining two vulnerabilities to achieve reliable root escalation. It affects many Linux distributions with kernels back to 2017. Due to an embargo breach, no CVE was assigned, and exploit code is publicly available. Mitigations include denylisting and unloading vulnerable kernel modules (esp4, esp6, rxrpc), applying live patches such as those from CloudLinux KernelCare, and installing patched kernels from testing repositories like AlmaLinux. Denylisting esp4 and esp6 disables IPsec ESP, and unloading rxrpc impacts RxRPC-dependent services, so administrators must assess operational impact before mitigation.

The vulnerability allows an unprivileged local user to escalate privileges to root on most major Linux distributions with kernels dating back to approximately 2017. This can lead to full system compromise. The exploit modifies the page cache of read-only files in memory, potentially allowing attackers to override critical binaries and escape container environments. The public availability of exploit code increases the risk of exploitation. Systems relying on IPsec ESP or RxRPC services may experience disruption if mitigations are applied without proper assessment.

Patched kernels and live patches are currently in active build and testing for several distributions. Until patches are applied, immediate mitigation involves unloading and denylisting the vulnerable kernel modules esp4, esp6, and rxrpc to prevent their loading. Note that denylisting esp4 and esp6 disables IPsec ESP functionality, and unloading rxrpc affects RxRPC-dependent services such as AFS filesystems; assess impact before applying. CloudLinux KernelCare live patches are available for affected CloudLinux versions, allowing patching without reboot. AlmaLinux has published patched kernels in testing repositories; apply these and reboot once stable versions are released. After patching, remove the denylist entries to restore normal module loading. Monitor vendor advisories for official patch releases and update systems promptly.