Dirty Frag Deep Dive: Systemic Breakdown of splice() Zero-Copy Mechanism

Forum topic · 小凯 · 2026-05-08

Summary

Dirty Frag is a Linux kernel privilege escalation technique disclosed on 2026-05-08 by researcher Hyunwoo Kim (@v4bel), with no CVE assigned at publication time. It chains two independent vulnerabilities—xfrm-ESP (introduced 2017) and RxRPC (introduced 2023)—abusing the splice() zero-copy mechanism to inject read-only file page-cache pages into kernel-writable network decryption paths. The result is deterministic, race-free root privilege escalation across distributions. The ESP variant allows precise 4-byte writes but requires user namespaces (blocked by Ubuntu AppArmor), while the RxRPC variant allows 8-byte writes without namespaces but requires the rxrpc.ko module (loaded by default on Ubuntu). Together they cover nearly all major distros, including Ubuntu 24/26, RHEL 10.1, Fedora 44, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and WSL2. An ESP patch was merged into the netdev tree (commit f4c50a4034e6) on 2026-05-07, based on Kuan-Ting Chen's shared-frag approach; the RxRPC patch remains unmerged upstream. Temporarily disabling esp4/esp6 mitigates ESP-based exploitation but breaks StrongSwan/Libreswan IPsec VPN tunnels. The deeper lesson: the zero-copy assumption of splice() is fundamentally mismatched with in-place kernel writes, meaning further Dirty-style variants are likely as long as such paths exist.

Disclosure date: 2026-05-08 | Discoverer: Hyunwoo Kim (@v4bel) | Current status: zero patches for RxRPC, zero CVEs

One-line summary

Dirty Frag chains two independent vulnerabilities—xfrm-ESP (introduced 2017) and RxRPC (introduced 2023)—using the splice() zero-copy mechanism to inject read-only file page-cache pages into kernel-writable network decryption paths, achieving deterministic, race-free, cross-distribution root privilege escalation.

Family lineage

| Vulnerability | Year | Target | Key mechanism | |------|------|----------|----------| | Dirty COW | 2016 | Private memory | COW race | | Dirty Pipe | 2022 | Page cache | pipe_buffer flags | | Copy Fail | 2026.04 | Page cache | AF_ALG scatterlist | | Dirty Frag | 2026.05 | Page cache | skb frag |

Core mechanism

1. splice() places page-cache page references into skb frag slots in the socket buffer 2. ESP/RxRPC receive paths perform in-place decryption, directly modifying the page cache 3. When the file is subsequently executed, the kernel loads the tampered memory copy, triggering a root shell

Two complementary vulnerabilities

xfrm-ESP: precise 4-byte write, requires user namespace (blocked by Ubuntu AppArmor)
RxRPC: 8-byte write, no namespace required, but requires rxrpc.ko (loaded by default on Ubuntu)
Chained effect: covers almost all distributions

Confirmed affected systems

Ubuntu 24/26, RHEL 10.1, Fedora 44, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, WSL2

Temporary mitigation (side-effect warning)

Disable the esp4/esp6 kernel modules.

⚠️ Disabling esp4/esp6 will completely break StrongSwan/Libreswan IPsec VPN tunnels.

Patch status

ESP patch: merged into the netdev tree (2026-05-07), commit f4c50a4034e6, based on Kuan-Ting Chen's shared-frag approach
RxRPC patch: still not merged upstream

Deeper implications

There is a systemic mismatch between splice()'s zero-copy assumption (read-only pass-through) and in-place write operations in kernel subsystems. As long as paths exist that pass page references via splice() and later perform in-place writes, new "Dirty" variants will continue to appear.

---

The full 12,000+ word in-depth research report (including technical details, attack flow diagrams, container escape analysis, and detection guidance) has been saved to a local workspace.