CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

Dirty Frag / Fragnesia

trend · trend:dirty-frag-linux-kernel-page-cache-lpe

Collective name (Red Hat: 'Copy Fail 2') for a family of Linux kernel local-privilege-escalation flaws (CVE-2026-43284, CVE-2026-43500, CVE-2026-46300) in which unmarked shared page-cache fragments surviving TCP-receive coalescing reach in-place modification via the IPsec ESP and RxRPC networking decrypt/verify paths, letting a local attacker corrupt a privileged read-only binary's in-memory copy and gain root; Kubernetes-context proof-of-concept exploits are public and Red Hat confirms RHEL kernels are affected by two of the three CVEs (Wiz Research, 2026-05-08/13; Red Hat RHSB-2026-003; Aikido Security, 2026-09-04).

Aliases: Dirty Frag, Fragnesia, Copy Fail 2

Coverage
3
2 about it · 1 mention · first 2026-05-09 → last 2026-10-11
Latest activity
2026-09-05
Dirty Frag gives local users root through two kernel page-cache write flaws; Microsoft saw su-based…
Peak priority
high
1 high · 1 notable
Targets
·
regions: europe, switzerland
Sources cited
17
13 hosts

Action items (2)

Do-now tasks recorded on the entries about Dirty Frag / Fragnesia, newest first. Check the date before acting on an older one.

  • Apply the distribution kernel update for CVE-2026-43284 and CVE-2026-43500, and confirm the fix for CVE-2026-46300 is installed too.
    2026-05-09CVE-2026-43284 +1
  • Patch CVE-2026-46300 on multi-tenant Linux hosts, container nodes and CI runners. Apply the distribution kernel update and reboot. Until then, where IPsec is not in use, block and unload the esp4, esp6 and rxrpc modules (this breaks IPsec), then drop the page cache so any binary already modified in memory reloads from disk.
    2026-05-15CVE-2026-46300

Defender insights

What each entry about Dirty Frag / Fragnesia tells a defender to do, newest first.

2026-05-09HIGHDirty Frag gives local users root through two kernel page-cache write flaws; Microsoft saw su-based escalation that may be this or Copy Fail

Exposure · detection

2026-05-15NOTABLECVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), PoC public

Exposure

Story timeline

Every entry that names Dirty Frag / Fragnesia, newest first. Rows tagged mention only name it in passing: they are listed for completeness and add nothing to the action items, pivots or ATT&CK profile on this page.

  1. 2026-05-15CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), PoC public
    trending-vulnerabilities
  2. 2026-05-09CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released
    trending-vulnerabilitiesDirty Frag gives local users root through two kernel page-cache write flaws; Microsoft saw su-based escalation that may be this or Copy Fail
  3. 2026-05-09CVE-2026-31431 Copy Fail: Linux kernel AF_ALG page-cache write gives any local user root on mainstream distributions, public exploit, CISA KEV-listed (CVSS 7.8)
    mentiontrending-vulnerabilitiesCopy Fail turns an unprivileged Linux shell into root with one portable script; CISA lists it as exploited

Hunting pivots

CVEs
CVE-2026-43284CVE-2026-43500CVE-2026-46300
Affected products
Linux kernel
Tags
lpe ×2patch-available ×2poc-public ×2vulnerabilities ×2
ATT&CK techniques (2 across 1 tactic)

2 techniques observed across 2 entries about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Privilege EscalationExploitation for Privilege Escalation · Escape to Host

Privilege Escalation TA0004

T1068Exploitation for Privilege Escalation×2

Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · 2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic · ATT&CK page ↗

T1611Escape to Host×2

Adversaries may break out of a container or virtualized environment to gain access to the underlying host. This can allow an adversary access to other containerized or virtualized resources from the host level or to the host itself. In principle, containerized / virtualized resources should provide a clear separation of application functionality and be isolated from the host environment.

Evidence: 2026-05-15/cve-2026-46300-linux-kernel-local-privilege-escalation-via-x · 2026-05-09/cve-2026-43284-cve-2026-43500-linux-dirty-frag-deterministic · ATT&CK page ↗

Entries about Dirty Frag / Fragnesia (2)

2026-05-09 · view entry permalink →

HIGHCVE-2026-43284 +1updatedNATOB2

CVE-2026-43284 / CVE-2026-43500 Linux Dirty Frag: deterministic page-cache write to root through xfrm-ESP and RxRPC, public exploit, fixes released

Researcher Hyunwoo Kim (V4bel) published "Dirty Frag" on 2026-05-07, after the embargo had been broken by external factors and before patches or CVE ids existed (V4bel, 2026-05-07). It is two page-cache write flaws: CVE-2026-43284 in the xfrm-ESP (IPsec) receive path, in the kernel since 2017 and fixed in mainline commit f4c50a4034e6, and CVE-2026-43500 in RxRPC, in the kernel since 2023 and fixed in mainline commit aa54b1d27fe0 (V4bel, 2026-05-07). In both, a page-cache page planted with splice() sits in a fragment of a network buffer and the receiving code decrypts it in place, writing into the cached copy of a file: the ESP variant stores 4 attacker-chosen bytes per trigger into a setuid binary such as su, and the RxRPC variant stores 8 bytes whose value the attacker brute-forces through the session key, aimed at /etc/passwd; the result is deterministic root without a race window (V4bel write-up, 2026-05-07). The ESP variant needs the privilege to create a user namespace, which Ubuntu sometimes blocks through AppArmor; the RxRPC variant needs no namespace but depends on the rxrpc module, which most distributions do not ship and Ubuntu loads by default (V4bel, 2026-05-07). The kernel.org CNA scores CVE-2026-43284 CVSS 8.8, and NVD and CISA score CVE-2026-43500 7.8 (Ubuntu, 2026-05-08). Microsoft reports limited in-the-wild privilege escalation involving su that "may be indicative of techniques associated with either" Dirty Frag or Copy Fail: an SSH session ran an ELF binary that escalated through su, then edited a GLPI LDAP authentication file and deleted and read web session files (Microsoft Security Blog, 2026-05-08).

The researcher tested the exploit on Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10 and Fedora 44 (V4bel, 2026-05-07). Ubuntu publishes fixed kernels for every supported release from 18.04 to 26.04 (Ubuntu, 2026-05-08), and Red Hat states that fixes are released for all affected products and that CVE-2026-43500 does not affect Red Hat products (Red Hat RHSB-2026-003). Where a fix cannot be applied, NCSC-CH advises blocking or removing the esp4, esp6 and rxrpc modules (NCSC-CH advisory 12547, 2026-05-08), which affects IPsec and AFS where they are in use (Ubuntu, 2026-05-08); on RHEL, user.max_user_namespaces=0 blocks the ESP path (Red Hat RHSB-2026-003). Red Hat notes that, because of its similarities with Copy Fail, Dirty Frag is also called "Copy Fail 2" (Red Hat RHSB-2026-003); Copy Fail is a separate, earlier flaw, CVE-2026-31431 (Microsoft Security Blog, 2026-05-08).

Updaterun 2026-05-11-migratedcvesevidenceregionssourcesbody

Microsoft Threat Intelligence reported on 2026-05-08 "limited in-the-wild activity where privilege escalation involving ‘su’ is observed, and which may be indicative of techniques associated with either “Dirty Frag” or “Copy Fail”": an external connection gained SSH access, spawned a shell and ran an ELF binary that immediately escalated through su (Microsoft Security Blog, 2026-05-08). Microsoft does not say which flaw the binary used.

Red Hat's bulletin RHSB-2026-003 lists the Dirty Frag CVEs, states that CVE-2026-43500 does not affect Red Hat products, and gives user.max_user_namespaces=0 as a targeted mitigation alongside blocking the ESP modules (Red Hat RHSB-2026-003). NCSC.ch's Security Hub post 12547 of 2026-05-08 noted a public proof of concept and advised temporarily blacklisting esp4, esp6 and rxrpc (NCSC-CH advisory 12547, 2026-05-08), and Belgium's CCB issued a parallel advisory (CCB Belgium, 2026-05-08).

The mainline fixes are f4c50a4034e6 for the ESP flaw and aa54b1d27fe0 for the RxRPC flaw (V4bel, 2026-05-07). Microsoft warns that modifications made before mitigation may persist in cached file content even after the vulnerable modules are disabled (Microsoft Security Blog, 2026-05-08). On Ubuntu systems where AppArmor blocks unprivileged user namespaces, the ESP path cannot be triggered, while the RxRPC path needs no namespace (V4bel, 2026-05-07). Blocking rxrpc breaks AFS and other RxRPC uses, so for those hosts the kernel update is the fix (Ubuntu, 2026-05-08).

Updaterun 2026-09-05T0409Z-intelupdated_atcvesentitiesclassificationtechniquessourcesactionssourcing_notebody

A related flaw, CVE-2026-46300 ("Fragnesia"), reopens this vulnerability's underlying page-cache-write primitive even on hosts already patched against CVE-2026-43284: a bug from 2013 in the code that merges packet fragments drops the marker that flags a fragment as page-cache-backed, which the original xfrm-ESP fix depends on to decide whether it is safe to decrypt in place (Aikido Security). Red Hat's own security bulletin groups all three CVEs under the collective "Dirty Frag" name, notes that the family is similar enough to the earlier Copy Fail flaw to be called "Copy Fail 2", and confirms CVE-2026-46300 affects supported Red Hat Enterprise Linux kernels; administrators who patched only against CVE-2026-43284/CVE-2026-43500 should verify the CVE-2026-46300 fix is applied too (Red Hat RHSB-2026-003). Public proof-of-concept exploits for this family now target Kubernetes specifically, extending the exposure to container-shared-kernel environments beyond the bare-metal/VM case originally described (Aikido Security).

Correctionrun 2026-10-11T1307Z-audittitleheadlinesummaryevent_datetagscvesaffected_productssourcesevidencesourcing_notebodyactions

Microsoft's observation of su-based escalation "may be indicative of techniques associated with either" Dirty Frag or Copy Fail (Microsoft Security Blog, 2026-05-08), so exploitation of these two CVEs is not confirmed. The flaws work by decrypting a splice()-planted page-cache page in place, not through DMA remapping (V4bel write-up, 2026-05-07); mainline fixed the ESP flaw in f4c50a4034e6 and the RxRPC flaw in aa54b1d27fe0, and distribution kernels are available (V4bel, 2026-05-07) (Ubuntu, 2026-05-08). Red Hat says CVE-2026-43500 does not affect its products and gives user.max_user_namespaces=0 as its targeted mitigation (Red Hat RHSB-2026-003). The write modifies the page cache in RAM (V4bel write-up, 2026-05-07) while the file on disk never changes (Aikido Security, 2026-09-04), so a file-write watch does not fire. The ESP variant stores 4 attacker-chosen bytes per trigger into a setuid binary such as su; the RxRPC variant stores 8 bytes whose value the attacker brute-forces through the session key, aimed at /etc/passwd (V4bel write-up, 2026-05-07).

vulnerability09 May 05:00Zmulti-sourceOpen finding →
Sources: V4bel (Hyunwoo Kim) · V4bel write-up · Microsoft Security Blog · NCSC-CH advisory 12547 · Red Hat RHSB-2026-003 · Ubuntu · CCB Belgium · Aikido Security · FIRST.org EPSS API

2026-05-15 · view entry permalink →

NOTABLECVE-2026-46300updatedNATOB2

CVE-2026-46300, Linux kernel: local privilege escalation via xfrm ESP-in-TCP ("Fragnesia"), PoC public

CVE-2026-46300 ("Fragnesia") is a local privilege escalation flaw in the Linux kernel's XFRM ESP-in-TCP subsystem. Improper handling of shared page fragments during skb coalescing lets an unprivileged local user modify read-only file contents in the kernel page cache and gain root (Wiz Research, 2026-05-13). The public exploit uses user and network namespaces to obtain CAP_NET_ADMIN inside an isolated namespace, installs a crafted ESP security association over NETLINK_XFRM and overwrites the start of /usr/bin/su in the page cache only, so the on-disk binary never changes (Wiz Research, 2026-05-13). Microsoft's analysts noted that an attacker can modify any file the user can read, including /etc/passwd, not only su (Help Net Security, 2026-05-14). Dirty Frag discoverer Hyunwoo Kim says the flaw was accidentally activated by the patch for CVE-2026-43284 (Help Net Security, 2026-05-14). William Bowling of Zellic.io found it with the company's AI-agentic auditing tool, and a technical explainer and proof-of-concept exploit are public (Help Net Security, 2026-05-14).

The flaw needs local code execution, so it is a post-compromise root primitive rather than an entry point (Wiz Research, 2026-05-13). Risk is highest on shared Linux hosts, container clusters where the page cache is shared across the host, CI runners and build farms, and cloud services running user code (Help Net Security, 2026-05-14). Ubuntu's default AppArmor restriction on unprivileged user namespaces is a partial mitigation that forces an extra bypass (Wiz Research, 2026-05-13). Microsoft reported no evidence of in-the-wild exploitation at disclosure (Help Net Security, 2026-05-14). At disclosure, AlmaLinux and CloudLinux had released patched kernels (Help Net Security, 2026-05-14).

Three vulnerabilities, collectively known as "Dirty Frag", have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products.

Red Hat (RHSB-2026-003) 2026-07-03

Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them.

Researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape.

Aikido Security 2026-09-04
Updaterun 2026-09-05T0409Z-intelupdated_atcvessummarysourcesevidenceentitiestechniquesclassificationsourcing_notebody

Red Hat rates CVE-2026-46300 CVSS 7.8 (Red Hat Product Security, 2026-05-13). Red Hat's own security bulletin groups it under the collective "Dirty Frag" name alongside CVE-2026-43284 and CVE-2026-43500, labelling it specifically "Fragnesia (skb coalescing via ESP-in-TCP)": "three vulnerabilities, collectively known as 'Dirty Frag', have been identified in networking subsystems of the Linux kernel, two of which affect Red Hat products" (Red Hat RHSB-2026-003, 2026-07-03). Applicability splits per CVE: "Red Hat says CVE-2026-43500 doesn't affect its products, while CVE-2026-43284 and CVE-2026-46300 do affect supported Red Hat Enterprise Linux kernels and anything built on them" (Aikido Security, 2026-09-04). Any RHEL, OpenShift or RHEL CoreOS estate must therefore confirm the CVE-2026-46300 fix specifically, not only the earlier two. Exploitation now extends to a container-relevant proof-of-concept: "researchers have already published working proof-of-concept exploits for Kubernetes, and Ubuntu spells out the risk of a container escape" (Aikido Security, 2026-09-04). Because containers share the host kernel, a compromised workload that can reach the vulnerable code path (governed by seccomp, pod security and user-namespace settings) can escalate to root on the node (Aikido Security, 2026-09-04). No source states confirmed in-the-wild exploitation of this specific CVE. Microsoft's previously reported limited in-the-wild activity ("privilege escalation involving 'su'") was itself stated as ambiguous between the "Dirty Frag" family and the separate, earlier "Copy Fail" vulnerability (CVE-2026-31431) (Microsoft Security Blog, 2026-05-08). That is not a distinction between the two Dirty Frag CVEs themselves, and not specific evidence of exploitation for CVE-2026-46300.

Correctionrun 2026-09-30T0639Z-auditsourcesevidencebodysourcing_noteactionsentities

The interim mitigation is corrected. Until the kernel update is deployed, block and unload the esp4, esp6 and rxrpc modules where they are not needed (Wiz Research, 2026-05-13 · Help Net Security, 2026-05-14). Blocking esp4 and esp6 breaks IPsec, and Red Hat's IPsec-preserving alternative is disabling unprivileged user namespaces (Red Hat RHSB-2026-003, 2026-07-03). At disclosure AlmaLinux and CloudLinux had shipped patched kernels (Help Net Security, 2026-05-14). The entry previously named other kernel modules, a CAP_NET_ADMIN restriction, an affected version range and wider distribution patch coverage that its sources do not state, and it wrongly described Dirty Frag discoverer Hyunwoo Kim as a Wiz researcher.

vulnerability15 May 05:00Zmulti-sourceOpen finding →
Sources: Wiz Research, 2026-05-13 · Help Net Security, 2026-05-14 · Red Hat (RHSB-2026-003) · Red Hat Product Security · Aikido Security · FIRST.org EPSS API · Microsoft Security Blog

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Vulns3

Source distribution

  • access.redhat.com2 (12%)
  • api.first.org2 (12%)
  • github.com2 (12%)
  • ubuntu.com2 (12%)
  • aikido.dev1 (6%)
  • ccb.belgium.be1 (6%)
  • cert.europa.eu1 (6%)
  • cisa.gov1 (6%)
  • other5 (29%)
All cited sources (17)