"Dirty Frag" — another universal Linux root zero-day, same class as Copy Fail, PoC public with no patches available

Dirty Frag is a deterministic Linux kernel privilege escalation that chains two page-cache write flaws, xfrm-ESP Page-Cache Write and RxRPC Page-Cache Write, to modify protected system files in memory without authorization and put a local attacker on root across all major distributions with a single command. Hyunwoo Kim published the documentation, the disclosure rationale and the full exploit to oss-security at 18:56 UTC on May 7 after a third party broke the embargo; the exploit repository V4bel/dirtyfrag went public 38 minutes earlier, so working exploit code predates every vendor response. No CVE has been assigned and no distribution ships a fix. The ESP half is an old bug: Steffen Klassert's January 17, 2017 commit cac2661c53f3, which let esp4 skip skb_cow_data on the fast path, opened a window the disclosure measures at roughly nine years, matching the age of the algif_aead fragment handling in the original report. The upstream fix, f4c50a4034e6 in the netdev net tree dated May 4, states the mechanism precisely: MSG_SPLICE_PAGES attaches pipe pages straight into an skb, the datagram paths never set SKBFL_SHARED_FRAG, and ESP input decrypts in place over memory it does not own.

The chaining is the part to read twice, because neither flaw alone roots the fleet. The disclosure explains that the ESP vector yields an arbitrary 4-byte store primitive like Copy Fail but needs permission to create a user namespace, which AppArmor policy on Ubuntu often blocks, while the RxRPC vector needs no namespace but its module is rarely loaded anywhere except Ubuntu, where rxrpc.ko comes up by default. The blind spots cover each other, and the tested set is not theoretical: Ubuntu 24.04.4 on 6.17.0-23-generic, RHEL 10.1 on 6.12.0-124.49.1.el10_1, CentOS Stream 10, AlmaLinux 10, openSUSE Tumbleweed and Fedora 44 all fall. This is the third member of the Dirty Pipe page-cache-write class after Copy Fail, and unlike race-condition LPEs it is deterministic, needs no timing window, and fails without a kernel panic, so unsuccessful attempts leave no crash trail. It lands while Copy Fail, CVE-2026-31431, already sits on the CISA KEV catalog with a May 15 remediation deadline, which is direct evidence that attackers work this class operationally. A public, race-free root exploit with zero patch availability inverts the usual calculus: this time the defenders have nothing to deploy.

Mitigation is module denial, not patching. Write the disclosure's blacklist, install esp4 /bin/false, install esp6 /bin/false and install rxrpc /bin/false, into /etc/modprobe.d/dirtyfrag.conf, rmmod esp4 esp6 rxrpc, and afterward run echo 3 > /proc/sys/vm/drop_caches, which the PoC documentation requires because the exploit leaves the page cache contaminated until flush or reboot. Inventory first: hosts without IPsec endpoints can drop esp4 and esp6 immediately, hosts without AFS will not miss rxrpc, and the real availability cost concentrates on IPsec VPN terminators and AFS clients, which need tighter restriction of local shell access until their vendor backports f4c50a4034e6. The hunt is concrete because the exploit is public: watch process and exec logs for a binary named exp built with gcc -O0 -Wall -o exp exp.c -lutil, for clones of a dirtyfrag repository landing in world-writable directories, and for esp4, esp6 or rxrpc module loads on hosts with no IPsec or AFS reason to load them.

Two developments would change this assessment. The first distribution advisory backporting the ESP fix, or any upstream fix at all for the RxRPC half, which did not exist at disclosure, converts a mitigation story into a patch story and starts the fleet rollout clock. The first credible exploitation telemetry, vendor or mass-scan, would confirm what the KEV-listed Copy Fail precedent already implies, that this chain is in operator playbooks, and would justify accepting IPsec and AFS breakage on exposed hosts rather than the residual risk of keeping the modules loaded.