Dirty Frag is a new Linux bug putting your system at risk – and there’s no easy fix yet


redlock-gettyimages-1333105479

hh5800/iStock / Getty Images Plus via Getty Images

Follow ZDNET: Add us as a preferred source on Google.


ZDNET’s key takeaways

  • With one compromised account, Dirty Frag can expose your system.
  • No patch can protect you from all possible attacks yet.
  • To stay safe, you’ll need to block several services, including VPNs.

Linux has been having a rough few weeks. First, the Copy Fail security hole was uncovered by AI researchers. In that case, the patches were quickly made and distributed. We weren’t so lucky with the newly disclosed Linux kernel flaw, dubbed Dirty Frag, which was also, it seems, discovered with AI’s help, but patches are still in the works.

Also: Linux is getting a security wake-up call – why it was inevitable and I’m not worried

Security researcher Hyunwoo Kim, who disclosed the issue on May 7, describes Dirty Frag as an extension of the same bug class as previous high-profile Linux kernel flaws, 2022’s Dirty Pipe and Copy Fail. Like those flaws, Dirty Frag exploits kernel code paths that write to memory pages accessible to unprivileged user space, but it targets a different structure: the fragment field of sk_buff networking buffers.

Also: Immutable Linux delivers serious security – here are your 5 best options

Kim told the Linux kernel maintainers about the vulnerability at the end of April. Unfortunately, the coordinated disclosure and patch processes quickly went off the rails. On May 7, while distributions were still shipping fixes for the related Copy Fail flaw, detailed Dirty Frag technical information and a working proof-of-concept exploit for the xfrm-ESP component appeared online after an embargo break by an unrelated third party. Now, we’re all in trouble.

What is Dirty Frag?

Dirty Frag is a local privilege escalation vulnerability chain that exploits logic bugs in Linux’s networking and authentication stacks to corrupt data in the kernel’s page cache, enabling an unprivileged account to escalate to root. 

It works by targeting two separate networking subsystems: the IPsec Encapsulating Security Payload, or xfrm-ESP, path, tracked as CVE-2026-43284, and the RxRPC authentication path, tracked as CVE-2026-43500.

By chaining these flaws, attackers can modify what should be read-only, page-cache-backed system files in memory and then trigger them to run with elevated privileges, without ever touching your file system.

Also: This critical Linux vulnerability is putting millions of systems at risk – how to protect yours

Once in, Dirty Frag exploits “page-cache write primitives” in kernel fast paths used for encrypted networking and remote file system authentication. By carefully choosing the target, an attacker can overwrite pieces of ostensibly read-only files in memory, such as executables or configuration files, and then execute or reload the modified files as root. 

From there, the sky’s the limit, and attackers can do pretty much whatever they want.

The good news — yes, there is some — is that attackers typically need an existing foothold, such as an unprivileged shell via SSH, a web shell, or a compromised container, to use Dirty Frag to escalate.

On the other hand, because the underlying bug is a logic error rather than a timing-sensitive race, the exploit is unusually reliable and does not cause kernel panics when it fails. In other words, someone can attack your Linux system over and over again until they break in, and you’ll never know about it.

Defenders scrambled to assess exposure

It did not take long for attackers to take notice. Public exploit code was quickly mirrored across security blogs, GitHub repositories, and discussion forums, leaving defenders scrambling to assess exposure.

Also: Worried about the nationwide Canvas data breach? Take these 6 steps now

According to Microsoft’s threat intelligence team, Dirty Frag has already been observed in action. Hackers are using it to upgrade limited footholds on Linux systems to full root control across servers, cloud workloads, and containers.

So, who’s at risk? 

I’m sorry to say it’s pretty much everyone who uses any Linux distribution. Dirty Frag affects a wide range of Linux environments, from bare-metal servers and enterprise distributions to container hosts and cloud instances. This includes current and earlier releases of Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, Fedora, and openSUSE Tumbleweed, among others.

Canonical, Ubuntu’s parent company, warns: “In container deployments that may execute arbitrary third-party workloads, the vulnerability may additionally facilitate container escape scenarios, in addition to local privilege escalation on the host.” That’s the ultimate cloud-native computing nightmare.

Fortunately, “A proof-of-concept exploit has not been published yet for container escape.” 

So far. To the best of our knowledge. We hope.

Also: Best VPN services: Expert tested and recommended

While many of you were celebrating Mother’s Day, the Linux kernel community spent the weekend addressing the problem. CVE-2026-43284, the xfrm-ESP component, received an upstream fix in the mainline kernel on May 8, less than 24 hours after public disclosure, though that fix now needs to be backported across the many supported stable trees.

The RxRPC flaw, tracked as CVE-2026-43500, remains under evaluation. As of this writing, no upstream patch had been finalized. Linux vendors are issuing their own advisories and updates as they integrate the upstream changes.

What you should do immediately

Linux distributors, cloud providers, and hosting providers are urging customers to update to the latest kernel packages as they become available. They’re also urging administrators to blacklist esp4, esp6, and rxrpc modules as a stopgap. Keep in mind, however, that if you do so, you’re likely to disrupt IPsec VPNs or AFS-based workloads. On the other hand, you’ll be safer that way.

Also: Why Edge stores your passwords in plaintext, according to Microsoft

Debian and Ubuntu-related Linux distros

Canonical suggests the following steps. These will work on Ubuntu and related Linux distributions, like Mint.

Step 1. Block the modules

  • Block the modules by creating a /etc/modprobe.d/dirty-frag.conf file:
  • echo “install esp4 /bin/false” | sudo tee /etc/modprobe.d/dirty-frag.conf
  • echo “install esp6 /bin/false” | sudo tee -a /etc/modprobe.d/dirty-frag.conf
  • echo “install rxrpc /bin/false” | sudo tee -a /etc/modprobe.d/dirty-frag.conf
  • Regenerate the initramfs images to prevent the modules from being loaded during early boot:
  • sudo update-initramfs -u -k all

Step 2. Unload modules

  • Unload the modules, in case they are already loaded:
  • sudo rmmod esp4 esp6 rxrpc 2>/dev/null


Step 3. Confirm the modules aren’t loaded

  • Check whether the modules are still loaded:
  • grep -qE ‘^(esp4|esp6|rxrpc) ‘ /proc/modules && echo “Affected modules are loaded” || echo “Affected modules are NOT loaded”
  • If the previous action indicates that the modules are not loaded, no further action is required. However, unloading the modules may not be possible if applications are already using them. In these instances, a system reboot will enforce their blocking, but it will affect applications:
  • sudo reboot
  • Once kernel updates are available and installed, the mitigation can be removed:
  • sudo rm /etc/modprobe.d/dirty-frag.conf
  • sudo update-initramfs -u -k all

Also: The best mobile antivirus software: Expert tested and reviewed

Red Hat and related Linux distros

Red Hat suggests you run:

  • printf ‘install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n’ > /etc/modprobe.d/dirtyfrag.conf rmmod esp4 esp6 rxrpc 2>/dev/null; true

This approach, which will require disabling IPsec and AFS-based programs, will also work on CentOS, Rocky Linux, AlmaLinux, and other RHEL-related Linux distros.

Also: I’ve used Windows for decades, but I tried Linux to see if it’s truly ‘easy’ now – and one thing surprised me

SUSE Linux fixes

SUSE has a similar solution with the same warning about IPsec and AFS.

Create:

/etc/modprobe.d/10-copyfail2-fix.conf to remediate with the following lines:

  • blacklist esp4
  • blacklist esp6
  • blacklist rxrpc
  • install esp4 /bin/false
  • install esp6 /bin/false
  • install rxrpc /bin/false

The details vary from distro to distro, but the temporary fix is always the same: Use a modprobe configuration file to disable the potentially affected programs until the kernel patches are available and installed. 

Once that’s done, you can delete the emergency fixes and get back to business as usual.

Also: Google bets $32B on AI agent cyber force as security arms race escalates

Until full kernel fixes are broadly deployed and systems are rebooted, you should mitigate your system as soon as possible. After all, if you have even a single compromised user account, an attacker can use Dirty Frag to take complete control of your infrastructure.

Now, if you’ll excuse me, I have a bunch of servers and workstations to fix.





Source link

Leave a Reply

Subscribe to Our Newsletter

Get our latest articles delivered straight to your inbox. No spam, we promise.

Recent Reviews


If Game Two of their first-round playoff series with the Denver Nuggets saved the 2025-26 season for the Minnesota Timberwolves, Game Three showed why it should be saved. 

The Timberwolves were a different beast while decisively thumping the Nuggets, 113-96 Thursday night at Target Center, in a game that wasn’t nearly that close. These Wolves were the mythical creature we’d heard about in preseason lore, purposefully locked and loaded to be both marauding and staunch. They owned both ends of the court, gleefully transferring back and forth from irresistible force to immovable object. 

A quartet of Timberwolves deserve special mention, but it begins with Jaden McDaniels. After his team had toppled Denver to even the series at a game apiece Monday night, McDaniels used the sizable chip on his shoulder to etch some graffiti into the public discourse, casually castigating the most prominent Nuggets players by name as “bad defenders” in a matter-of-fact manner that had the media compelling him to confirm what he had just said. 

Trash talk is fleetingly fungible in the jaundiced social environment of 2026, functioning more like coupons than currency in that it needs to be rapidly leveraged before its expiration date. The common perception naturally was that McDaniels was calling out the Nuggets. But in a more subtle, profound way, he was also putting his teammates on notice. 

All season long the Timberwolves have procrastinated on their full potential, frequently demonstrating that their preseason talk about maturity and commitment was cheap. By contrast, those words uttered by McDaniels were expensive. He had just picked a fight with the opponent, leaving open the question of how many of his teammates would join him in the fray. 

That he would lead the charge was established early, after the Timberwolves’ top two scorers, Anthony Edwards and Julius Randle, had each missed a pair of open looks against Denver’s bad defenders in the game’s first 90 seconds.  

With the game still scoreless, the NBA’s best pick-and-roll combo, Nikola Jokic and Jamal Murray, were clustered around the foul line with Minnesota’s best defenders, McDaniels and Rudy Gobert. As they jammed up Jokic, McDaniels picked the ball loose and started sprint-dribbling the other way. To no one’s surprise, Donte “Ragu” DiVincenzo was also on his horse in transition, receiving a pass from McDaniels and then lobbing it back for a Jaden slam against a hapless Murray and Murray’s late-arriving teammate, Cam Johnson, who committed the foul that allowed McDaniels to finish with the “and-1” free throw. 

On the Timberwolves next offensive possession, McDaniels muscled his way to two offensive rebounds, feeding Ragu off the first one for a missed three-pointer, which he corralled for the second one and executed the putback in traffic. It was McDaniels 5, Nuggets 0, setting the tone for a game in which not only did the Wolves never trail, but never let the lead go under double digits after McDaniels made a consecutive pair of driving layups eight minutes into the game. 

“Spectacular. I thought his activity offensively in the first quarter was outstanding,” said Wolves coach Chris Finch after the game. “He was inspirational.” 

Among the most inspired were McDaniels fellow wing players, Ragu and Ayo Dosunmu. Ragu is exactly the kind of player who will have your back in a squabble, and his galvanized performance seemed borne of satisfaction that someone else had clarified the mission. As usual, the Timberwolves were at their best with him on the court: +20 in the 32:54 he played, -3 in the 15:06 he sat. 

“He makes so many hustle plays, momentum plays, different styles of plays.” Finch raved. “He’ll make a shot, get a transition bucket, he’ll rebound, get a steal, blow something up. So many different plays. He’s just a basketball player.”

Related: How the Timberwolves sparked a season-saving Game 2 comeback over the Nuggets in Denver

Then there was Ayo, whose fearless, blazing, bee-lines for the bucket were quicksilver kryptonite for a Nuggets defense that is neither swift nor rugged. “I’ve been waiting for him to wake up a little bit in this series,” Finch accurately observed. “The downhill mindset that he played with all season for us was back.”

Back with the sort of multipurpose propulsion that leaves witnesses with giddy whiplash. Ayo led the team with 25 points and 9 assists in 32 minutes of time-lapse hoops, the lone blemish being three clanks from long range. Why chuck treys when you can so easily undress players in the paint? Ayo was 10-for-12 on two-pointers and none of those dozen shots came from anywhere but beneath the rim. Five of his nine dimes likewise yielded layups or dunks, which means he personally accounted for 30 of the 68 points in the paint by the Timberwolves on Thursday, doubling up the Nuggets’ 34.

Which brings us to the non-wing in Game 3’s ring of honor, Rudy Gobert. For the third straight game, Gobert blunted the supposed advantage Denver had with the magical playmaker Nikola Jokic at the controls. Suffice to say that in the last five quarters, Jokic has shot 8-for-33 from the floor. If that continues, the Nuggets are toast in this series. 

When I asked Finch after the game if the herculean job Gobert was doing on Jokic made planning his defense simpler and better thus far, he replied, “Rudy is making all of us look good right now with his defense.” 

Amen.

If there is an asterisk on this game, it would be the absence of Denver’s brutishly versatile power forward Aaron Gordon. Nuggets coach David Adelman should be given a lot of credit for his honesty and transparency in dealing with the media during his first full season at the helm, but it came back to bite him and his team during the pregame presser, when he was clearly rattled and dejected by the sudden unavailability of Gordon, whose playing status went to “probable” to “out” in a period of a few hours due to a chronic calf strain. 

Gordon is far and away his team’s best defender, making the timing of his injury especially troublesome in the wake of McDaniels laying down his marker. Rattled is a good way to describe the entire team’s performance in the first quarter, an emotional wounding that needs to heal as fast as Gordon’s body if the Nuggets are going to be competitive in a series that had dramatically been flipped on its head over the past three days. 

That the Timberwolves played with such dominance despite mediocre outings from Ant and Randle would be a good thing for both of those current cornerstones to keep in mind. Ant was beset by foul trouble and Randle had a solid second quarter, but it stood out that neither player fully embraced what so often works on offense when the Wolves are at their best: Push the pace, move the ball, move without the ball, and make quick decisions. Ant and Randle can still be first among equals and blend into that catechism if they stay attuned to the possibilities of a greater good, one that all of sudden doesn’t have to end with them being postseason fodder for the Spurs or the Thunder. 

Not when you’ve got three wings at a collective peak, with a chaser of Rudy semi-clowning the Joker. 



Source link