Linux Privilege Escalation Flaws Spur Dirty Frag Alerts and Kernel Killswitch Proposal

Linux kernel developers are reviewing an emergency runtime mitigation called Killswitch after public disclosure of multiple local privilege escalation flaws, including Copy Fail (CVE-2026-31431) and the chained Dirty Frag bugs (CVE-2026-43284, CVE-2026-43500). Dirty Frag, disclosed by researcher Hyunwoo Kim and discussed by Red Hat and other outlets, affects kernel networking paths tied to IPSec ESP and RxRPC and can let an unprivileged local user gain root on many distributions. Copy Fail, a separate nine-year-old flaw in AF_ALG cryptographic sockets, was also reported as enabling reliable local root escalation by allowing controlled writes into the kernel page cache of readable files.

Government and vendor guidance warned that public proof-of-concept exploit code is available and that risk increases if the local flaws are paired with remote code execution. The Canadian Centre for Cyber Security said no universal fix was immediately available across all stable kernels and urged defenders to identify exposed systems, restrict local access, reduce privileges, regenerate initramfs, and disable vulnerable modules where possible. In parallel, a GitHub project circulated shell-based stopgap patching to disable or rename affected modules on running systems, while the proposed Killswitch mechanism would let administrators force selected kernel functions to return safely without executing until patched kernels can be deployed.