CopyFail, Dirty Frag and Fragnesia Flaws Can Give Local Linux Users Root Access
Summary
Three Linux kernel flaws let attackers with an existing foothold exploit page-cache corruption to gain root. Patching is the recommended fix; temporary module-disabling mitigations may disrupt IPsec, VPN or RxRPC workloads.
Key points
- CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300) are local privilege-escalation vulnerabilities.
- The flaws abuse zero-copy kernel paths to corrupt cached file contents in memory without changing the files on disk.
- Exploitation requires prior access to the system; the flaws do not provide remote code execution on their own and can enable an unprivileged user to gain root.
- Researchers publicly disclosed the flaws and proof-of-concept exploits between April 29 and May 13, 2026; the article says most popular Linux distributions were affected when they were announced.
- The recommended long-term fix is to install the latest supported kernel updates from the relevant Linux distribution.
- Temporary mitigations include disabling algif_aead for CopyFail, and esp4, esp6, and rxrpc for Dirty Frag and Fragnesia; these changes may disrupt crypto, IPsec/VPN, or RxRPC-dependent workloads.
Article Details
- Vulnerability Types
- Local privilege escalation
- Page-cache corruption through zero-copy kernel operations
- Arbitrary byte writes to the kernel page cache
- Exploitation Status
- not_reported
- Exploit Availability
- public_poc
- Patch Status
- partial
- Workarounds
- For CopyFail, disable and unload the algif_aead module.
- For Dirty Frag and Fragnesia, disable and unload the esp4, esp6, and rxrpc modules; these mitigations may impact IPsec/VPN and RxRPC/AFS use cases.
- Where supported, use LSM BPF to block access to AF_ALG sockets or the splice syscall.
MITRE ATT&CK
CVE
CVE-2026-31431All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).CVE-2026-43284All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).CVE-2026-43500All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).CVE-2026-46300All of these named vulnerabilities pertain to the Linux kernel’s zero-copy functionality, and are named CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and Fragnesia (CVE-2026-46300).
People
Chris RyanNamed author of the Huntress article.Hyunwoo KimAnnounced the Dirty Frag vulnerabilities and PoC exploit.Jamie LevyAcknowledged for contributions to the article.Jim DevilleAcknowledged for contributions to the article.Shivangi PandeyAcknowledged for contributions to the article.Tom LawrenceAcknowledged for contributions and cited for a write-up on mitigations.Tyler BohlmannAcknowledged for contributions to the article.William BowlingOf the V12 security team; announced Fragnesia and its PoC exploit.
Products
eBPFThis can be combined with one of Linux’s super-powers, eBPF, in the form of LSM BPF.Linux kernelOver the last two weeks, security researchers independently discovered multiple vulnerabilities in the Linux kernel that allow an unprivileged user to easily gain root access (local privilege escalation).Linux Security ModuleOne of the security features of the Linux kernel is LSM, or the Linux Security Module.OpenSSLnormal functionality, with the exception of: “userspace specifically configured to use AF_ALG — e.g. OpenSSL with the afalg engine explicitly enabled, some embedded crypto offload paths, or applications that bindStrongSwanThese are common with VPN implementations such as StrongSwan.