Dirtyfrag: Universal Linux LPE Uncovered

Thu, 07 May 2026 21:08:28 +0000

The Linux kernel, a bastion of open-source security, has once again demonstrated its Achilles’ heel: a new universal Local Privilege Escalation (LPE) vulnerability, dubbed “Dirtyfrag,” is bypassing existing defenses and granting root access with alarming ease. This isn’t just another CVE; it’s a chilling reminder that even hardened systems remain susceptible to fundamental kernel logic flaws.

The “Sink” Reopens: Why `xfrm-ESP Page-Cache Write` Is a Recurring Nightmare

Dirtyfrag isn’t an entirely novel attack vector. It builds upon the lessons learned from Dirty Pipe (CVE-2022-0847) and shares a strikingly similar exploitation “sink” with the “Copy Fail” vulnerability. The core of the exploit lies in an out-of-bounds write operation facilitated through plain network sockets, specifically via the xfrm-ESP Page-Cache Write mechanism. This is the same crucial pathway that Copy Fail exploited, and critically, Dirtyfrag circumvents the primary mitigation deployed against it: blacklisting the algif_aead module.

Privilege Escalation on The Coders Blog

Dirtyfrag: Universal Linux LPE Uncovered

The “Sink” Reopens: Why xfrm-ESP Page-Cache Write Is a Recurring Nightmare

The “Sink” Reopens: Why `xfrm-ESP Page-Cache Write` Is a Recurring Nightmare