Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild

This report analyzes two Linux kernel privilege-escalation issues—Copy Fail and DirtyFrag—that leverage page-cache corruption via legitimate kernel interfaces (AF_ALG, splice, AF_RXRPC, unshare namespaces) to reliably escalate local processes to root. It provides detection guidance (auditd syscall rules, EQL/ES|QL queries, process exec heuristics), recommended mitigations (kernel updates, module blacklisting, dropping page cache, restricting unprivileged user namespaces), and notes active exploitation and widely available public proofs-of-concept.