Disclosure date: 2026-05-08 | Discoverer: Hyunwoo Kim (@v4bel) | Current status: zero patches applied broadly, no CVE assigned yet
TL;DR
Dirty Frag chains two independent vulnerabilities — xfrm-ESP (introduced in 2017) and RxRPC (introduced in 2023) — abusing the splice() zero-copy mechanism to inject read-only file page-cache pages into kernel-writable network decryption paths, achieving deterministic, race-free, cross-distribution root privilege escalation.
Vulnerability Family Tree
| Vulnerability | Year | Target | Key mechanism | |------|------|------|------| | Dirty COW | 2016 | Private memory | COW race | | Dirty Pipe | 2022 | Page cache | pipe_buffer flags | | Copy Fail | 2026.04 | Page cache | AF_ALG scatterlist | | Dirty Frag | 2026.05 | Page cache | skb frag |
Core Mechanism
1. splice() places page-cache page references of a file into the socket buffer's skb frag slots
2. ESP/RxRPC receive path performs in-place decryption, directly modifying the page cache
3. When the file is subsequently executed, the kernel loads the tampered in-memory copy, triggering a root shell
Two Complementary Vulnerabilities
- xfrm-ESP: precise 4-byte write; requires user namespaces (blocked by Ubuntu AppArmor)
- RxRPC: 8-byte write, no namespace required, but needs rxrpc.ko (loaded by default on Ubuntu)
- Combined effect: covers nearly all distributions
- ESP patch: merged into the netdev tree (2026-05-07), commit f4c50a4034e6, based on Kuan-Ting Chen's shared-frag approach
- RxRPC patch: still not merged upstream
Confirmed Affected Systems
Ubuntu 24/26, RHEL 10.1, Fedora 44, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, WSL2
Temporary Mitigation (Side-Effect Warning)
Blocking/unloading esp4/esp6 mitigates the ESP variant.
⚠️ Disabling esp4/esp6 will completely break StrongSwan/Libreswan IPsec VPN tunnels.
Patch Status
Deeper Takeaway
There is a systemic mismatch between splice()'s zero-copy assumption (read-only pass-through) and in-place write operations in kernel subsystems. As long as code paths exist that pass page references via splice() and later write to them in place, new "Dirty" variants will continue to appear.
---
The full 12,000+ word in-depth research report (with technical details, attack flow diagrams, container escape analysis, and detection recommendations) is saved to the local workspace.