Dirty Frag outpaced Copy‑Fail: the second critical Linux vulnerability remains unpatched after a month.

Critical vulnerability Dirty Frag: what you need to know

How it works How dangerous? Any local user can gain root privileges on most popular Linux distributions released since 2017 (Ubuntu, Arch, RHEL, Fedora and even WSL 2 in Windows 11). Status of fixes At the time of publication there are no patches – neither in individual distributions nor in the mainline Linux kernel. How it manifests? The attack does not depend on system configuration and does not require precise timing. By running a small program, a user obtains administrator rights.

Affected platforms - Ubuntu 24/26

- Arch Linux (latest version)

- RHEL, CentOS Stream

- Fedora, AlmaLinux, OpenSUSE and other builds

How to protect The vulnerability is related to three kernel modules responsible for IPSec encryption:

1. esp4 – IPv4‑ESP
2. esp6 – IPv6‑ESP
3. rxrpc – RPC protocol over IPsec

These components are only needed in corporate VPN networks. Disabling them can quickly close the vulnerability without noticeable impact on regular workstations and servers.

Disclosure history - On April 30 the Linux kernel team received information about the issue.

- A third party breached an agreement and published details early, which, according to Tom’s Hardware, led to active exploitation by attackers.

How the attack works Dirty Frag, like Copy Fail, uses the zero‑copy mechanism in the kernel.

1. The attacker inserts a page cache descriptor into the splice system call.
2. This allows writing data to files that a regular user does not have write permission for.
3. Through these writes the user gains root privileges.

The vulnerability code is located in IPSec encryption modules. The first flaw – *xfrm-ESP Page Cache Write* – appeared in commit `cac2661c53f3` (2017).
AppArmor in Ubuntu closes this first breach, so the demo PoC additionally uses the second – *RxRPC Page‑Cache Write* from commit `2dc334f1a63a`.

Conclusion: Dirty Frag poses a serious threat to most modern Linux distributions. Until official patches appear, it is recommended to disable esp4/esp6/rxrpc modules or upgrade to a kernel version where the vulnerability has already been fixed.