Dirty Frag (also known as Copy Fail 2) is a high-impact local privilege escalation vulnerability in the Linux kernel. It allows an unprivileged local user to obtain root privileges on affected systems.
Discovered by Hyunwoo Kim (@v4bel), it is a successor to the earlier Copy Fail vulnerability.
- CVE: CVE-2026-43284 (xfrm/ESP) + CVE-2026-43500 (RxRPC)
- Severity: High (CVSS ~7.8)
- Exploitation: Reliable, deterministic root in a single command
- Disclosure Date: May 7, 2026
- Affected: Most Linux kernels since ~2017
The vulnerability originates from unsafe in-place decryption of shared socket buffer (skb) fragments referencing page cache pages, particularly when using splice(2) or sendfile(2).
This provides a powerful arbitrary page cache write primitive, which can be leveraged to overwrite sensitive files in memory and achieve full root access.
Primary attack vectors:
- xfrm / ESP (
esp4/esp6) - RxRPC (used by AFS)
- Unprivileged local attacker → Root shell
- Affects virtually all major Linux distributions
- Highly reliable with no race conditions
- Bypasses many existing kernel mitigations
Update to the latest patched kernel from your distribution as soon as possible.
Fixed in mainline kernel via commit f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4.
# Blacklist vulnerable modules
sudo sh -c 'printf "install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n" > /etc/modprobe.d/dirtyfrag.conf'
# Unload modules immediately
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true
# Drop page cache
echo 3 | sudo tee /proc/sys/vm/drop_caches >/dev/nullNote: This workaround disables IPsec and RxRPC/AFS functionality.
| Distribution | Status | Patched Version |
|---|---|---|
| AlmaLinux | Affected | Available |
| RHEL / Rocky | Affected | Rolling out |
| Ubuntu | Affected | Rolling out |
| Fedora | Affected | Available |
| Debian | Affected | In progress |
This repository is intended for educational and defensive security purposes only.
Stay safe. Patch early. Patch often. 🛡️