Full Report
Learn how critical Linux kernel flaws in CopyFail, Dirty Frag, and Fragnesia let unprivileged users escalate to root access. See what security teams can do to remediate.
Analysis Summary
# Vulnerability: Linux Kernel Page-Cache Corruption (CopyFail, Dirty Frag, and Fragnesia)
## CVE Details
- **CVE ID:**
- CVE-2026-31431 (CopyFail)
- CVE-2026-43284 & CVE-2026-43500 (Dirty Frag)
- CVE-2026-46300 (Fragnesia)
- **CVSS Score:** 7.8 (High) - *Typical score for Local Privilege Escalation*
- **CWE:** CWE-119 (Improper Restriction of Operations within the Bounds of a Memory Buffer) / CWE-440 (Expected Behavior Violation) / CWE-123 (Write-what-where Condition)
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** Widespread across most popular distributions; core components in the kernel are affected. Specific versions vary by distribution (Ubuntu, Debian, RHEL, Fedora, etc.).
- **Configurations:** Systems utilizing zero-copy functionality, specifically those with `algif_aead`, `esp4`, `esp6`, and `rxrpc` modules enabled.
## Vulnerability Description
These vulnerabilities belong to a class of page-cache corruption issues tied to the Linux kernel’s **zero-copy functionality**. Attackers abuse trusted system calls (syscalls) such as `splice` and `vmsplice` to manipulate memory.
By exploiting these mechanisms, an unprivileged user can alter the contents of cached files residing in RAM without modifying the original file on the physical disk. Because the kernel relies on the integrity of this cache for sensitive operations (such as authentication or binary execution), an attacker can inject malicious code or data into a privileged process's memory space, leading to a bypass of security controls.
## Exploitation
- **Status:** PoC available (Publicly released for all three vulnerability sets).
- **Complexity:** Low (Trivially easy to exploit; can be performed using native tools like Python).
- **Attack Vector:** Local (Requires an existing foothold on the system).
## Impact
- **Confidentiality:** High (Full administrative access allows exfiltration of any data).
- **Integrity:** High (Attackers can alter system files, install malicious tooling, and bypass security software).
- **Availability:** High (Root access allows for complete system shutdown or destruction).
## Remediation
### Patches
- Move to the latest supported kernel versions provided by your Linux distribution (e.g., via `apt upgrade`, `dnf update`, or `zypper patch`). Distributions are currently rolling out specific patches for CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, and CVE-2026-46300.
### Workarounds
*Note: These may impact production workloads.*
- **CopyFail:** Disable the `algif_aead` kernel module.
- **Dirty Frag / Fragnesia:** Disable `esp4`, `esp6`, and `rxrpc` modules.
- *Warning:* Disabling these may break IPsec/VPN connections and AFS-dependent environments.
## Detection
- **Indicators of Compromise:**
- Presence of unexpected Python scripts or exploit binaries in `/tmp` or user home directories.
- Unexpected elevation of privileges for low-privilege service accounts.
- System logs showing unusual module loading/unloading if workarounds are bypassed.
- **Detection methods and tools:**
- Auditd: Monitor for suspicious `splice` or `vmsplice` syscall patterns from unprivileged users.
- Use vulnerability scanners to check for outdated kernel versions against the listed CVEs.
## References
- **CopyFail PoC:** hxxps[://]github[.]com/theori-io/copy-fail-CVE-2026-31431
- **Dirty Frag Write-up:** hxxps[://]github[.]com/V4bel/dirtyfrag/blob/master/assets/write-up[.]md
- **Fragnesia PoC:** hxxps[://]github[.]com/v12-security/pocs/tree/main/fragnesia
- **Original Advisory:** hxxps[://]www[.]huntress[.]com/blog/linux-kernel-flaws-copyfail-dirty-frag-fragnesia