Bug 2467807 - [Major Incident] kernel: "Dirty Frag" is a new universal Local Privilege Escalation (LPE) vulnerability in the Linux kernel [fedora-all]
Summary: [Major Incident] kernel: "Dirty Frag" is a new universal Local Privilege Esca...
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: kernel
Version: rawhide
Hardware: Unspecified
OS: Unspecified
high
high
Target Milestone: ---
Assignee: Justin M. Forbes
QA Contact: Fedora Extras Quality Assurance
URL:
Whiteboard: {"flaws": ["781eadf5-5605-43f9-b058-8...
: 2469227 (view as bug list)
Depends On:
Blocks: CVE-2026-43284 CVE-2026-43500
TreeView+ depends on / blocked
 
Reported: 2026-05-07 19:17 UTC by Sandipan Roy
Modified: 2026-05-11 23:13 UTC (History)
18 users (show)

Fixed In Version: kernel-7.0.4-200.fc44
Clone Of:
Environment:
Last Closed: 2026-05-08 19:29:22 UTC
Type: ---
Embargoed:

Attachments (Terms of Use)

Description Sandipan Roy 2026-05-07 19:17:30 UTC 
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.

Reproducers, if any, will remain confidential and never be made public, unless done so by the security team.
Comment 1 Sandipan Roy 2026-05-07 19:20:40 UTC 
More Public Data Available via:

https://www.openwall.com/lists/oss-security/2026/05/07/8
https://dirtyfrag.io/


The “Dirty Frag” vulnerability is a chained local privilege escalation (LPE) issue in the Linux kernel that combines flaws in the ESP/XFRM and RXRPC subsystems to allow an unprivileged local attacker to gain root access on major Linux distributions. The attack abuses kernel page-cache manipulation and network protocol handling to overwrite privileged binaries and execute arbitrary code with elevated privileges. Exploitation differs by distribution: the ESP issue affects systems permitting unprivileged user namespaces, while the RXRPC issue impacts distributions with RXRPC enabled, such as Ubuntu. Together, the vulnerabilities provide broad cross-distribution root compromise capability, with mitigations involving disabling vulnerable kernel modules (esp4, esp6, and rxrpc) until upstream patches are fully merged and deployed.
Comment 2 Fedora Update System 2026-05-08 16:21:59 UTC 
FEDORA-2026-abc00fb4e8 (kernel-7.0.4-100.fc43) has been submitted as an update to Fedora 43.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-abc00fb4e8
Comment 3 Justin M. Forbes 2026-05-08 16:41:36 UTC 
Rawhide and ELN kernels kernel-7.1.0-0.rc2.260507g8ab992f815d6.19
https://bodhi.fedoraproject.org/updates/FEDORA-2026-f1e680122e (rawhide)
https://bodhi.fedoraproject.org/updates/FEDORA-2026-bc95c7765b (ELN)
Comment 4 Fedora Update System 2026-05-08 17:24:05 UTC 
FEDORA-2026-8cffa03dad (kernel-7.0.4-200.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-8cffa03dad
Comment 5 Fedora Update System 2026-05-08 19:29:22 UTC 
FEDORA-2026-8cffa03dad (kernel-7.0.4-200.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 6 Fedora Update System 2026-05-08 19:58:43 UTC 
FEDORA-2026-abc00fb4e8 (kernel-7.0.4-100.fc43) has been pushed to the Fedora 43 stable repository.
If problem still persists, please make note of it in this bug report.
Comment 7 Justin M. Forbes 2026-05-11 23:13:59 UTC 
*** Bug 2469227 has been marked as a duplicate of this bug. ***
Note You need to log in before you can comment on or make changes to this bug.