Dirty Frag: Linux Kernel Local Privilege Escalation via ESP and RxRPC

Unpatched kernel flaw chain (CVE-2026-43284, CVE-2026-43500) enables root escalation on major Linux distributions.

A newly disclosed Linux kernel local privilege escalation vulnerability chain, dubbed “Dirty Frag” and assignedCVE-2026-43284andCVE-2026-43500, enables attackers with local access to obtain root privileges by exploiting flaws in the ESP (IPsec) and RxRPC subsystems. While no official patches are currently available, a public proof-of-concept exists. Organizations should assume the vulnerability is valid and exploitable under certain conditions. This vulnerability isa successor to Copy Fail (CVE-2026-31431), and was discovered by Hyunwoo Kim (@v4bel). "CopyFail2" is another name for the same vulnerability, and is based on anexploit reversed from the fix commit.

Dirty Frag is a vulnerability chain combining two page-cache write primitives in the Linux kernel: one in the xfrm-ESP (IPsec) subsystem and another in RxRPC. Both flaws allow modification of page-cache-backed memory that is not exclusively owned by the kernel, enabling corruption of sensitive files and ultimately privilege escalation. Unlike race-condition-based exploits, this bug class is deterministic and highly reliable, similar to previous vulnerabilities like Copy Fail and Dirty Pipe.

To pull off this exploit, an attacker needs two things: access to specific vulnerable kernel interfaces and the ability to manipulate page-backed buffers (e.g., viasplice()-related paths).

However, there is a significant hurdle: the exploit usually requires high-level system permissions, such asCAP_NET_ADMIN. This means exploitation is less likely in hardened containerized environments (e.g., Kubernetes with default seccomp profiles). However, the risk remains significant for virtual machines or less restricted environments. The affected code paths date back to approximately 2017 (ESP) and 2023 (RxRPC), meaning a wide range of kernel versions may be impacted.

The full scope is still under investigation, but the following are known or likely affected:

Note: No complete version matrix is available at this time. The vulnerability was disclosed prior to embargo expiration after details became public due toreverse engineering of the fix.

Until official patches are released, the following mitigations are recommended:

1. Disable vulnerable kernel modules (temporary mitigation)

2. Assess operational impact before applying mitigation

Disabling esp4 / esp6 may break IPsec functionality

Disabling rxrpc may impact AFS-based environments

3. Prioritize patching when available

Monitor vendor advisories and apply kernel updates as soon as released

Some distributions (e.g., AlmaLinux testing repos) have early patched kernels available

4. Harden local access paths

Restrict shell access and enforce least privilege

Ensure SELinux/AppArmor is enforced

Avoid granting unnecessary capabilities (e.g.,CAP_NET_ADMIN)

5. Monitor for suspicious activity

Detect abnormal privilege escalations

Track execution of compilation tools and exploit-like behavior

Inspect integrity of critical system binaries

6. Post-mitigation cleanup (if compromise suspected)

Wiz customers can use the pre-built queries and advisory in theWiz Threat Intel Centerto search for relevant instances in their environment. Wiz Research will continue to update that advisory as the situation develops.

Dirty Frag github

Alma Linux advisory

RedHat advisory

Cloud Linux advisory

AWS advisory

With Wiz in Lovable, every builder can catch and fix risks in real time, keeping apps secure as they’re created

Ready to hit Zero Code Criticals? Here's how Wiz helps you get there and stay there, with the badge to prove you did.

What usage patterns, plugin adoption, and configuration choices reveal about the Jenkins attack surface.

Get a personalized demo

©2026Wiz, Inc.

StatusPrivacy PolicyTerms of UseModern Slavery StatementCookie Settings