CopyFail, Dirty Frag, And Fragnesia: Linux Page Cache Corruption Vulnerabilities Enabling LPE

Linux privilege escalation vulnerabilities continue to be a major concern for defenders because they can turn a limited local foothold into full system compromise. In recent weeks, three related vulnerability groups have drawn attention across the Linux security community: CopyFail, Dirty Frag, and Fragnesia.

These vulnerabilities are tracked as:

• CopyFail — CVE-2026-31431
• Dirty Frag — CVE-2026-43284 and CVE-2026-43500
• Fragnesia — CVE-2026-46300

Although each vulnerability exists in a different part of the Linux kernel, they share a common theme: they abuse kernel behavior related to memory-backed file content and page cache corruption. This makes them especially dangerous in post-compromise scenarios, where an attacker already has the ability to run code locally on a vulnerable system.

CopyFail, Dirty Frag, and Fragnesia belong to a wider family of vulnerabilities that rely on memory page cache corruption. This type of attack was most notably seen in 2022 with Dirty Pipe, where attackers could modify cached file content in memory without directly changing the file on disk. The newer vulnerabilities follow a similar defensive challenge: the on-disk file may remain unchanged, while the in-memory version used by the kernel can be corrupted and abused for privilege escalation.

These are not remote code execution vulnerabilities by themselves. However, once an attacker gains low-privileged access through a compromised web application, container workload, CI/CD job, shared user account, or exposed service, these vulnerabilities may provide a reliable path to root.

CopyFail, Dirty Frag, and Fragnesia underscore a recurring theme: in-kernel optimizations for performance can be weaponized as root exploits. All three bugs rely on page-cache memory corruption caused by in-place writes. By design, zero-copy syscalls like splice(), sendfile(), and vmsplice() optimize throughput by moving page references instead of data copies. However, when paired with certain crypto or IPsec operations, these references can be abused to overwrite cached file data in RAM. Since the kernel trusts that cached data as valid, every reader (even root) sees the poisoned content. The result is that an attacker can alter (and then execute) privileged binaries in memory without ever changing them on disk.

This family of exploits is not new. The infamous Dirty Pipe (CVE-2022-0847) also corrupted page-cache via a similar mechanism, overwriting the cache of any readable file. CopyFail, Dirty Frag, and Fragnesia can be thought of as successors in this lineage: each takes a different kernel path that uses in-place operations and flips them into deterministic write primitives.

The result is a reliable local privilege escalation path when the required vulnerable kernel paths are available.

These vulnerabilities abuse trusted memory-related syscalls such as `splice()` and related zero-copy mechanisms to alter cached file contents in RAM without changing the file on disk.

For defenders, these bugs are especially concerning because they break the usual assumptions about files: an attacker can corrupt an executable in memory and run it as root, all with a few system calls. Given their reliability (no race conditions required) and the fact that fully-working exploits are already public, any delay in patching is dangerous.

Each of these bugs was disclosed within weeks of each other (see timeline below), and all are fixed by kernel updates. However, the widespread nature of the affected code means

Many Linux distributions may be affected depending on kernel version, enabled modules, and vendor backports.

Overview

CopyFail, tracked as CVE-2026-31431, surfaced by Xint Code / Theori is a Linux kernel local privilege escalation vulnerability affecting the kernel crypto subsystem. The issue exists in the interaction between AF_ALG, AEAD decryption, splice(), and the authencesn crypto template.

The vulnerability can be abused by an unprivileged local attacker to corrupt the page cache of readable files, including setuid-root binaries such as /usr/bin/su. If successfully exploited, the attacker can execute the corrupted in-memory version of the binary and gain root privileges.

CopyFail is especially concerning because it does not require a race condition, repeated timing attempts, or highly specific system tuning. The attack is based on a deterministic logic flaw in how the kernel handles in-place crypto operations.

Technical Explanation

CopyFail abuses how the Linux kernel handles crypto operations through the AF_ALG socket interface. AF_ALG exposes parts of the Linux kernel cryptographic API to userspace, allowing user programs to request cryptographic operations from the kernel.

On vulnerable systems, an attacker can open an AF_ALG socket using the AEAD algorithm:

authencesn(hmac(sha256),cbc(aes))

The exploit becomes possible when this AF_ALG crypto path is combined with splice(). The splice() syscall can move file-backed page-cache references into the crypto pipeline without copying the file data into a separate safe buffer. Because of an in-place AEAD optimization, the kernel may treat source and destination buffers as the same structure.

In the vulnerable path, the authencesn crypto template writes beyond the expected AEAD output boundary. This gives the attacker a controlled 4-byte write primitive into the page cache of a readable file at a chosen offset. By repeating the operation across multiple offsets, the attacker can implant a small payload into the cached copy of a setuid-root binary such as /usr/bin/su.

The important point is that the file on disk is not directly modified. Instead, the attacker poisons the cached version in memory. When the setuid binary is later executed, the modified in-memory version runs with root privileges.

Attack Flow

1. The attacker gains local unprivileged code execution on a vulnerable Linux system.
2. The attacker opens an AF_ALG socket and binds it to the vulnerable AEAD crypto configuration.
3. The attacker uses splice() to bring file-backed page-cache pages into the crypto path.
4. The vulnerability creates a controlled 4-byte write primitive into cached file memory.
5. The attacker repeats the write to corrupt the cached version of a setuid-root binary.
6. When the binary is executed, the corrupted in-memory version runs attacker-controlled code as root.

CopyFail PoC execution Demo Placeholder

Why CopyFail Is Dangerous

CopyFail is dangerous because it turns local code execution into root privilege escalation through memory corruption in the page cache. Since the file on disk may remain unchanged, simple file-integrity checks may not detect the attack. This makes the vulnerability especially relevant in post-compromise scenarios, where a low-privileged foothold can be escalated to full system control.

It is also relevant to containerized environments because containers share the host kernel. If the host kernel is vulnerable and the required functionality is exposed, a compromised container may increase the risk to the underlying host.

Overview

Dirty Frag refers to two Linux kernel local privilege escalation vulnerabilities:

• CVE-2026-43284 — XFRM/ESP page-cache write issue
• CVE-2026-43500 — RxRPC page-cache write issue

Dirty Frag discovered and reported by Hyunwoo Kim (@v4bel), follows the same general theme as CopyFail: abusing kernel behavior to corrupt page-cache memory and escalate privileges to root. However, instead of the AF_ALG crypto subsystem, Dirty Frag involves the Linux kernel’s IPsec ESP/XFRM and RxRPC paths.

The issue is important because it shows that page-cache corruption is not limited to one kernel component. Similar dangerous patterns can appear wherever the kernel performs in-place processing over shared memory pages.

Technical Explanation

Dirty Frag affects Linux kernel paths related to IPsec ESP/XFRM and RxRPC. The vulnerable behavior exists in fragment-handling and in-place decryption paths, where the kernel may process paged fragments as if they are privately owned, even when they may reference shared page-cache memory.

Dirty Frag should be understood as a chained page-cache corruption issue involving both the RxRPC and ESP/XFRM paths. In the RxRPC stage, an attacker can create an AF_RXRPC socket and register an RxRPC key using behavior such as:

add_key(“rxrpc”)

This helps prepare the fragment write primitive. The ESP/XFRM path then performs in-place decryption over shared page fragments, allowing attacker-controlled data to be written into page-cache memory.

Unlike CopyFail, which provides a smaller 4-byte write primitive, Dirty Frag can provide a larger page-cache write primitive. This can be used to poison the cached version of a sensitive readable file, commonly a setuid-root binary such as /usr/bin/su.

Again, the important point is that this is not a normal file write. The attacker is not directly modifying the file on disk. Instead, the attack modifies cached file content in RAM, which the kernel may later use during execution.

Attack Flow

1. The attacker gains local unprivileged execution on the vulnerable Linux system.
2. The attacker abuses the RxRPC and ESP/XFRM paths as part of the Dirty Frag exploitation chain.
3. The RxRPC path helps prepare the fragment write primitive.
4. The ESP/XFRM path performs in-place decryption over shared page fragments.
5. Kernel fragment handling results in page-cache corruption.
6. The attacker poisons the cached version of a sensitive readable file.
7. When the corrupted cached binary is executed, the attacker gains root privileges.

Dirty Frag PoC Execution Demo

Why Dirty Frag Is Dangerous

Dirty Frag is dangerous because it expands the page-cache corruption problem beyond the crypto subsystem seen in CopyFail. It demonstrates that similar privilege escalation primitives can appear in different kernel subsystems, especially where memory fragments, zero-copy behavior, and in-place processing are used.

Dirty Frag is also important for enterprise and cloud environments. Depending on kernel version, enabled modules, and vendor backports, affected systems may include servers, containers, and Linux workloads running across production environments.

Overview

Fragnesia, tracked as CVE-2026-46300, disclosed by William Bowling of V12 Security, is another Linux kernel local privilege escalation vulnerability in the broader family of page-cache corruption issues.

Fragnesia affects the Linux kernel’s XFRM ESP-in-TCP subsystem. Like Dirty Frag, it is related to ESP/XFRM handling, but it is a separate vulnerability and should not be treated as simply another name for Dirty Frag.

The vulnerability can allow an unprivileged local attacker to modify read-only file contents in the kernel page cache and use that corruption to escalate privileges to root.

Technical Explanation

Fragnesia abuses a logic flaw in how the Linux kernel handles ESP-in-TCP traffic. ESP-in-TCP is used to carry IPsec ESP traffic over TCP in certain network configurations.

The exploit path involves data that has already been spliced into a TCP socket receive queue. After this data is queued, the socket can be switched into espintcp mode. The kernel then incorrectly treats those queued file-backed pages as ESP ciphertext and performs AES-GCM decryption in-place on them.

By carefully controlling IV or nonce values, the attacker can influence the AES-GCM output stream and turn the vulnerable behavior into a deterministic one-byte write primitive against the page cache. Although one byte sounds small, repeating the primitive allows an attacker to build a payload inside the cached copy of a setuid-root binary such as

/usr/bin/su.

As with CopyFail and Dirty Frag, the on-disk file may remain unchanged. The attack targets the in-memory cached version of the file, allowing the attacker to execute attacker-controlled code when the poisoned binary is launched.

Attack Flow

1. The attacker gains local unprivileged execution on a vulnerable Linux system.
2. The attacker uses splice() to place file-backed pages into a TCP socket receive queue.
3. The attacker switches the socket into espintcp mode.
4. The kernel incorrectly treats queued file-backed pages as ESP ciphertext.
5. AES-GCM decryption occurs in-place over shared page-cache memory.
6. The attacker uses controlled IV/nonce values to create a one-byte write primitive.
7. Repeating the primitive allows the attacker to poison a cached setuid binary.
8. Executing the poisoned binary results in root privilege escalation.

Fragnesia PoC execution Demo

Why Fragnesia Is Dangerous

Fragnesia is dangerous because it shows that Dirty Frag-style issues are not limited to one exact code path. Even after defenders understand CopyFail and Dirty Frag, Fragnesia demonstrates that similar page-cache corruption patterns can appear in adjacent Linux kernel networking and encryption subsystems.

It also reinforces the wider lesson from this vulnerability family: kernel optimizations that rely on zero-copy behavior, shared pages, or in-place processing can become dangerous when ownership and memory safety assumptions are wrong.

Although CopyFail, Dirty Frag, and Fragnesia affect different kernel paths, they follow a similar exploitation pattern.

An attacker first needs local unprivileged access to the system. From there, the attacker abuses a special kernel interface such as AF_ALG, RxRPC, or ESP-in-TCP, usually together with zero-copy behavior such as splice().

The vulnerable kernel path then performs in-place crypto or fragment handling over shared page-cache memory. This allows the attacker to poison the cached version of a privileged file, commonly a setuid-root binary such as:

/usr/bin/su

When the binary is executed, the modified in-memory version runs attacker-controlled code as root. In many cases, the file on disk may remain unchanged, which makes the attack harder to detect using traditional file-integrity checks.

This shared pattern is what connects CopyFail, Dirty Frag, and Fragnesia as part of the same broader class of Linux kernel page-cache corruption vulnerabilities.

Defenders should also monitor for:

• unusual privilege escalation behavior
• unexpected execution of setuid binaries
• suspicious memory-backed file activity
• abnormal root process creation chains

• Linux Kernel
• AF_ALG Crypto Interface
• XFRM / ESP
• RxRPC
• ESP-in-TCP
• Linux Containers
• CI/CD Runners
• Shared Hosting Environments
• Multi-user Linux Systems

Prioritize Kernel Updates

Organizations should prioritize vendor kernel updates immediately, especially for:

• internet-facing Linux servers
• container hosts
• CI/CD runners
• jump servers
• shared Linux systems

Apply Temporary Mitigations Carefully

Where patching is delayed, organizations may consider:

• disabling AF_ALG-related modules
• restricting ESP/XFRM functionality
• limiting RxRPC exposure

These mitigations should be tested carefully because they may impact:

• IPsec VPNs
• cryptographic applications
• enterprise networking functionality

Reboot into Updated Kernels

Installing the updated package alone is not sufficient.

Systems must be rebooted into the patched kernel to fully remove exposure.

CopyFail, Dirty Frag, and Fragnesia are root-privilege escalators by design. They exploit deep kernel mechanisms in a way that breaks implicit trust in memory. In practical terms, Once an attacker has local code execution on a vulnerable system where the required kernel functionality is available, these bugs may provide a reliable path to root. The good news is that patches exist for all affected kernels. The urgent action is to update or apply mitigations now. Until then, treat any unprivileged foothold as a de facto breach: an attacker could use these flaws to take over your system in seconds. Vigilance, rapid patching, and robust detection are the best defenses. As security teams have learned with Dirty Pipe, these page-cache attacks are more a pattern than a one-off bug expect more in this vein. Stay informed and prepare accordingly.

Wizard Cyber helps organizations assess, detect, and respond to high-impact Linux privilege escalation vulnerabilities such as CopyFail, Dirty Frag, and Fragnesia through threat intelligence, vulnerability prioritization, monitoring, and incident response support.

• Threat Intelligence (CSI):
  We track emerging vulnerability disclosures, exploit availability, affected products, and attacker tradecraft to help organizations understand which systems require immediate attention.
• Detection and Monitoring:
  Wizard Cyber can support in detecting suspicious behavior linked to these vulnerabilities, including signs of AF_ALG abuse, suspicious `splice()`-related activity, abnormal execution of setuid binaries, unexpected privilege transitions to root, and unusual XFRM, ESP, or RxRPC-related activity where endpoint, kernel, or SIEM telemetry is available.
• Incident Response Support:
  Where exploitation is suspected, Wizard Cyber can support containment, host investigation, evidence collection, root-cause analysis, and recovery guidance.