Dirty Frag Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released

Dirty Frag is a newly disclosed, CVE-pending Linux kernel local privilege escalation that combines two page-cache write flaws (xfrm-ESP and RxRPC) to deterministically obtain root on virtually all major Linux distributions; a public exploit surfaced after an embargo break on May 7, 2026. The report details how the flaws allow in-place modification of page-cache pages (e.g., /etc/passwd or /usr/bin/su), lists confirmed affected kernels/distributions, describes partial upstream patches and available module-blacklisting workarounds, and warns administrators to weigh IPsec/RxRPC impact until distribution backports are released.