{"id":241449,"date":"2026-05-08T03:45:00","date_gmt":"2026-05-08T07:45:00","guid":{"rendered":"https:\/\/news-you-need.com\/index.php\/2026\/05\/08\/new-linux-dirty-frag-zero-day-gives-root-on-all-major-distros\/"},"modified":"2026-05-08T04:10:12","modified_gmt":"2026-05-08T08:10:12","slug":"new-linux-dirty-frag-zero-day-gives-root-on-all-major-distros","status":"publish","type":"post","link":"https:\/\/news-you-need.com\/index.php\/2026\/05\/08\/new-linux-dirty-frag-zero-day-gives-root-on-all-major-distros\/","title":{"rendered":"New Linux ‘Dirty Frag’ zero-day gives root on all major distros"},"content":{"rendered":"

New Linux ‘Dirty Frag’ zero-day gives root on all major distros<\/a><\/p>\n

https:\/\/www.bleepingcomputer.com\/news\/security\/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges\/<\/a><\/p>\n

Publish Date: 2026-05-08 03:45:00<\/a><\/p>\n

Source Domain: www.bleepingcomputer.com<\/a><\/p>\n

\n

A new Linux zero-day vulnerability, named Dirty Frag, allows local attackers to gain root privileges on most major Linux distributions with a single command.<\/p>\n

Security researcher Hyunwoo Kim, who disclosed the flaw earlier today and published a proof-of-concept (PoC) exploit, says this privilege escalation flaw was introduced roughly nine years ago in the Linux kernel’s algif_aead cryptographic algorithm interface.<\/p>\n

Dirty Frag works by chaining two separate kernel flaws, the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability, to modify protected system files in memory without authorization and achieve privilege escalation.<\/p>\n

Also, while Dirty Frag belongs to the same class as the Dirty Pipe and Copy Fail Linux vulnerabilities, it exploits the fragment field of a different kernel data structure.<\/p>\n

The vulnerability has yet to receive a CVE-ID for tracking and affects a wide range of Linux distros, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, and Fedora, which have not yet received patches.<\/p>\n

“As with the previous Copy Fail vulnerability, Dirty Frag likewise allows\u00a0immediate root privilege escalation on all major distributions, and it\u00a0
\nchains two separate vulnerabilities,”\u00a0Kim said.<\/p>\n

“Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.”<\/p>\n

\"DirtyDirty Frag demo (Hyunwoo Kim)<\/p>\n

\u200bKim released complete Dirty Frag documentation and a PoC exploit with distribution maintainers’ agreement after an embargo on full public disclosure was broken on May 7, 2026, when an unrelated third party independently published the exploit.<\/p>\n

“Because the embargo has currently been broken, no patch or CVE exists. After consultation with the maintainers on linux-distros@vs.openwall.org and at their request, this Dirty Frag document is being published,” Kim said.<\/p>\n

To…<\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

New Linux ‘Dirty Frag’ zero-day gives root on all major distros https:\/\/www.bleepingcomputer.com\/news\/security\/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges\/ Publish Date: 2026-05-08…<\/p>\n","protected":false},"author":1,"featured_media":241452,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"fifu_image_url":"https:\/\/www.bleepstatic.com\/content\/hl-images\/2026\/05\/08\/Dirty-Frag-Linux.jpg","fifu_image_alt":"","footnotes":""},"categories":[48],"tags":[143,144,90,31,97,89,71,98,94,57,79,27],"class_list":["post-241449","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-linux","tag-almalinux","tag-centos","tag-cve","tag-exploit","tag-fedora","tag-flaw","tag-linux","tag-opensuse","tag-red-hat-enterprise-linux","tag-security","tag-ubuntu","tag-vulnerability"],"_links":{"self":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/241449"}],"collection":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/comments?post=241449"}],"version-history":[{"count":1,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/241449\/revisions"}],"predecessor-version":[{"id":241453,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/posts\/241449\/revisions\/241453"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media\/241452"}],"wp:attachment":[{"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/media?parent=241449"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/categories?post=241449"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/news-you-need.com\/index.php\/wp-json\/wp\/v2\/tags?post=241449"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}