Skip to content

Back to the catalog

Panic at the Distro
huntress.comwriteup

Panic at the Distro

Huntress breaks down four Linux kernel zero-copy vulnerabilities disclosed in rapid succession in 2026 — CopyFail (CVE-2026-31431) in algif_aead, Dirty Frag (CVE-2026-43284, CVE-2026-43500) in xfrm-ESP/RxRPC, and Fragnesia (CVE-2026-46300) in XFRM ESP-in-TCP — all of which let an unprivileged local user overwrite read-only page-cache entries (e.g. /etc/passwd, /usr/bin/su) via splice()-based zero-copy syscalls to gain root, echoing the 2022 Dirty Pipe (CVE-2022-0847) technique. The article explains the zero-copy/page-cache mechanics behind the bug class, notes all four were found with LLM assistance, and gives kernel-module-disabling mitigations plus a recommendation to enable LSM BPF for defense.

TL;DR Huntress analyzes CopyFail, Dirty Frag, and Fragnesia — a wave of Dirty Pipe-style Linux kernel zero-copy page-cache LPE bugs — with root cause details and mitigation steps.
Open original ↗
Document

What it is

Huntress's explainer on four related Linux kernel local privilege escalation bugs disclosed in rapid succession: CopyFail (CVE-2026-31431), Dirty Frag (CVE-2026-43284, CVE-2026-43500), and Fragnesia (CVE-2026-46300), all in the same page-cache-corruption family as 2022's Dirty Pipe (CVE-2022-0847). The value beyond the catalog summary is the disclosure timeline, the differing mechanisms, the origin commits, and — importantly for triage — the exploitation preconditions.

How it works

All four abuse zero-copy syscalls (splice, sendfile, vmsplice) to plant a reference to a read-only file's page cache page into a send-path buffer; a kernel subsystem then performs an in-place write on that buffer, corrupting the cached copy of the file in RAM. Every subsequent read sees the modified data, so overwriting /etc/passwd or /usr/bin/su yields root. The bugs differ in what buffer gets corrupted: Dirty Pipe overwrites struct pipe_buffer; Dirty Frag overwrites the frag of struct sk_buff. CopyFail lives in the algif_aead crypto API; Dirty Frag in xfrm-ESP and RxRPC; Fragnesia in XFRM ESP-in-TCP. Per its author, Fragnesia is a logic bug requiring no race condition, making it more deterministic than typical page-cache races.

Preconditions / Affected

  • Local access required. None of these are remotely exploitable — an attacker must already have an unprivileged foothold. This is the key prioritization signal the summary omits.
  • Bugs reside in core kernel components shipped by virtually every distribution; most popular distros were affected at disclosure with little patch lead time.
  • Origin commits are old: CopyFail was introduced in kernel 4.14 (2017) via commit 72548b093ee3; Dirty Frag's two bugs date to 2017 and 2023.

Timeline

  • Apr 29, 2026 — Xint Code disclosed CopyFail + PoC.
  • May 7, 2026 — Hyunwoo Kim disclosed Dirty Frag + PoC (the two CVEs chained give the same result).
  • May 13, 2026 — William Bowling (V12) disclosed Fragnesia + PoC.

All were reportedly found with the help of large language models, and PoCs were public shortly after discovery.

Caveats

The fetched page gives no patch versions, mitigation commands, or detection logic — the "what to do" content is not present in the excerpt available. Treat this as a threat-explainer for prioritization, not a remediation source; confirm your distro's kernel patch status separately.

Organisations named here

  • Dirty Pipe
  • splice

CVEs named here

  • CVE-2026-31431
  • CVE-2026-43284
  • CVE-2026-43500
  • CVE-2026-46300
  • CVE-2022-0847

Technologies named here

  • Linux kernel
  • Python
  • Linux kernel xfrm-ESP submodule
  • LSM
  • Linux kernel RxRPC submodule
  • eBPF
  • Linux kernel XFRM ESP-in-TCP subsystem
  • LSM BPF
  • StrongSwan
  • AFS
  • Linux

Techniques named here

  • Zero-copy page cache corruption / poisoning
  • Local privilege escalation via page cache overwrite
  • In-place crypto on frag slot of sk_buff
  • Dirty Frag
  • Fragnesia

Threat actors named here

  • CopyFail

Related in Offensive Security