A new, unpatched local privilege escalation vulnerability in the Linux kernel — dubbed “Dirty Frag” — has been publicly disclosed, enabling unprivileged local users to gain root access on most major Linux distributions. The flaw affects Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44.
Discovered by security researcher Hyunwoo Kim, Dirty Frag works by chaining two page-cache write vulnerabilities: one in the IPSec (xfrm-ESP) subsystem introduced in January 2017, and another in the RxRPC subsystem introduced in June 2023. Unlike many kernel exploits, Dirty Frag is a deterministic logic bug — no race condition is required, the kernel does not panic on failure, and the success rate is extremely high. A working exploit is already public after the embargo was broken on May 7 when an unrelated third party published exploit details.
The vulnerability extends the class of page-cache attacks that includes the infamous Dirty Pipe and the recently exploited Copy Fail (CVE-2026-31431). No CVE identifier has been assigned yet, and no patch is currently available.
Source
The Hacker News · BleepingComputer · Exploit on GitHub
Commentary
This is bad. An unpatched, deterministic root escalation with a public exploit affecting every mainstream distro is about as serious as local privilege escalation gets. The fact that it chains two bugs — one nearly a decade old — is a grim reminder of how much latent attack surface exists in kernel networking code.
Organizations running Linux in production should be monitoring this closely and preparing to apply patches the moment they drop. In the meantime, restricting unprivileged user namespaces (which Ubuntu does via AppArmor) provides some mitigation, but most other distributions are fully exposed.