{"id":17109,"date":"2026-05-08T23:57:01","date_gmt":"2026-05-09T05:57:01","guid":{"rendered":"https:\/\/www.supportpro.com\/blog\/?p=17109"},"modified":"2026-05-08T23:57:07","modified_gmt":"2026-05-09T05:57:07","slug":"dirty-frag-universal-linux-lpe","status":"publish","type":"post","link":"https:\/\/www.supportpro.com\/blog\/dirty-frag-universal-linux-lpe\/","title":{"rendered":"Dirty Frag: Universal Linux LPE"},"content":{"rendered":"\n

Dirty Frag is a vulnerability in Linux that allows an attacker to gain higher access or permissions than they are normally allowed on the system<\/p>\n\n\n\n

This vulnerability was disclosed earlier than planned due to an embargo break, which means information about the vulnerability was released publicly before the agreed-upon disclosure date.<\/p>\n\n\n\n

It’s a part of Linux kernel page cache exploits \u2014 following Dirty Pipe (2022) and Copy Fail (earlier this year).<\/p>\n\n\n\n\n\n\n\n

What are Linux kernel page cache exploits?<\/strong><\/p>\n\n\n\n

The page cache in Linux is a system memory area where frequently accessed file data is temporarily stored. <\/p>\n\n\n\n

It speeds up file operations because reading from memory is faster than reading from disk. <\/p>\n\n\n\n

However, if an attacker can manipulate the page cache incorrectly, they can sometimes modify memory in ways they shouldn\u2019t, bypassing normal permissions.<\/p>\n\n\n\n

So, the dirty Frag uses two Linux kernel bugs (xfrm-ESP Page-Cache Write<\/strong> and RxRPC Page-Cache Write<\/strong>) together and tricks the kernel\u2019s page cache to gain root access.<\/p>\n\n\n\n

xfrm-ESP Page-Cache Write \u2014<\/strong>The bug exists in Linux\u2019s IPsec networking code, where it skips an important memory safety check. <\/p>\n\n\n\n

This bug lets an attacker change a specific part of the kernel\u2019s memory cache, giving them control over that memory, which is a key part of how the Dirty Frag exploit works.<\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n

RxRPC Page-Cache Write \u2014<\/strong><\/p>\n\n\n\n

Another part of Dirty Frag exploits a bug in the RxRPC networking subsystem.<\/p>\n\n\n\n

The attacker calculates a key outside the kernel, then uses it to safely overwrite memory, making the exploit work every time. <\/p>\n\n\n\n

\"\"<\/a><\/figure>\n\n\n\n
\"\"<\/a><\/figure>\n\n\n\n

The (xfrm-ESP Page-Cache Write<\/strong>) vulnerability affects all recent Linux versions released since 2017. Any unprivileged local user can exploit it to gain full root (administrative) control.<\/p>\n\n\n\n

The xfrm-ESP Page-Cache Write vulnerability has existed since 2017, while the RxRPC Page-Cache Write vulnerability appeared in June 2023<\/p>\n\n\n\n

To exploit the Dirty Frag vulnerability, an attacker needs some level of initial access to the system. This could include:<\/p>\n\n\n\n