Linux “Dirty Frag” zero-day with PoC exploit enables root privilege escalation on major distributions

A newly disclosed Linux kernel zero-day vulnerability dubbed “Dirty Frag” can allow local attackers to escalate privileges to root on many widely used Linux distributions, according to documentation and a proof-of-concept (PoC) exploit released this week.

Security researcher Hyunwoo Kim said the bug stems from a class of issues affecting the Linux kernel’s algif_aead cryptographic algorithm interface, and that it was introduced roughly nine years ago.

How the exploit works

Kim said “Dirty Frag” achieves privilege escalation by chaining two kernel page-cache write flaws — described as the “xfrm-ESP Page-Cache Write” issue and the “RxRPC Page-Cache Write” issue — to modify protected system files in memory without authorization.

He said the technique is deterministic and does not rely on a race condition.

Affected systems and patch status

Kim said the issue affects major distributions including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, and Fedora.

He also said an embargo on full public disclosure was broken on May 7, 2026, leading to the publication of documentation and a PoC exploit. At the time of disclosure, he said patches had not yet been released for affected systems.

The two vulnerabilities chained by the exploit are tracked as:

- CVE-2026-43284 for the xfrm-ESP issue - CVE-2026-43500 for the RxRPC issue

Mitigation

As a mitigation, Kim advised disabling the vulnerable kernel modules esp4, esp6, and rxrpc, noting that doing so may break IPsec VPN functionality and AFS distributed network file systems.