Bug 2467807

Summary:	[Major Incident] kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel [fedora-all]
Product:	[Fedora] Fedora	Reporter:	Sandipan Roy <saroy>
Component:	kernel	Assignee:	Justin M. Forbes <jforbes>
Status:	CLOSED ERRATA	QA Contact:	Fedora Extras Quality Assurance <extras-qa>
Severity:	high	Docs Contact:
Priority:	high
Version:	rawhide	CC:	acaringi, adscvr, airlied, allarkin, edgar.hoch, hans, hpa, jforbes, jkirkland, jwboyer, kernel-maint, linville, masami256, mchehab, nickolasjcarr, ptalbert, steved, suraj.ghimire7
Target Milestone:	---	Keywords:	Security, SecurityTracking
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:	{"flaws": ["781eadf5-5605-43f9-b058-824d54a3b773"]}
Fixed In Version:	kernel-7.0.4-200.fc44	Doc Type:	---
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2026-05-08 19:29:22 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:
Bug Blocks:	2467771, 2468273

Description Sandipan Roy 2026-05-07 19:17:30 UTC

Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Reproducers, if any, will remain confidential and never be made public, unless done so by the security team.

Comment 1 Sandipan Roy 2026-05-07 19:20:40 UTC

More Public Data Available via:

https://www.openwall.com/lists/oss-security/2026/05/07/8
https://dirtyfrag.io/


The “Dirty Frag” vulnerability is a chained local privilege escalation (LPE) issue in the Linux kernel that combines flaws in the ESP/XFRM and RXRPC subsystems to allow an unprivileged local attacker to gain root access on major Linux distributions. The attack abuses kernel page-cache manipulation and network protocol handling to overwrite privileged binaries and execute arbitrary code with elevated privileges. Exploitation differs by distribution: the ESP issue affects systems permitting unprivileged user namespaces, while the RXRPC issue impacts distributions with RXRPC enabled, such as Ubuntu. Together, the vulnerabilities provide broad cross-distribution root compromise capability, with mitigations involving disabling vulnerable kernel modules (esp4, esp6, and rxrpc) until upstream patches are fully merged and deployed.

Comment 2 Fedora Update System 2026-05-08 16:21:59 UTC

FEDORA-2026-abc00fb4e8 (kernel-7.0.4-100.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-abc00fb4e8

Comment 3 Justin M. Forbes 2026-05-08 16:41:36 UTC

Rawhide and ELN kernels kernel-7.1.0-0.rc2.260507g8ab992f815d6.19
https://bodhi.fedoraproject.org/updates/FEDORA-2026-f1e680122e (rawhide)
https://bodhi.fedoraproject.org/updates/FEDORA-2026-bc95c7765b (ELN)

Comment 4 Fedora Update System 2026-05-08 17:24:05 UTC

FEDORA-2026-8cffa03dad (kernel-7.0.4-200.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8cffa03dad

Comment 5 Fedora Update System 2026-05-08 19:29:22 UTC

FEDORA-2026-8cffa03dad (kernel-7.0.4-200.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2026-05-08 19:58:43 UTC

FEDORA-2026-abc00fb4e8 (kernel-7.0.4-100.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 7 Justin M. Forbes 2026-05-11 23:13:59 UTC

*** Bug 2469227 has been marked as a duplicate of this bug. ***