Dirty Frag Linux Kernel LPE Enables Immediate Root Access Across Major Distros

Researchers publicly disclosed Dirty Frag, a Linux kernel local privilege escalation chain that can give an unprivileged local user immediate root access across major distributions. The disclosure said the issue combines flaws in the in-place decryption fast paths for esp4, esp6, and rxrpc, allowing page-cache corruption or plaintext exposure in externally backed paged fragments. Public write-ups and exploit repositories described two working paths: overwriting /usr/bin/su with a root shell via the ESP/XFRM stack, or corrupting /etc/passwd through RXRPC/RXKAD behavior so a UID 0 account can be used without a password.

The bug was published without patches or CVE assignments after an embargo was reportedly broken, and exploit code was quickly made public through oss-sec, GitHub, and security forums. A related GitHub proof of concept, Copy Fail 2: Electric Boogaloo, tied the ESP path to the MSG_SPLICE_PAGES no-copy-on-write fast path and reported successful exploitation on Debian, Arch, Fedora, and newer Ubuntu releases, while noting older Ubuntu 22.04 kernels were not affected by that specific path. AlmaLinux said all supported releases were affected, issued patched kernels in testing by backporting the upstream ESP fix, and recommended temporary mitigations including blacklisting or unloading esp4, esp6, and rxrpc modules and dropping page cache if compromise is suspected.