Dirty Frag: Unpatched Local Privilege Escalation Vulnerability in Linux Kernel
Patch all Linux systems to the latest kernel version that addresses Dirty Frag before exploitation.
Patch all Linux systems to the latest kernel version that includes the Dirty Frag fix, verify the patch, and monitor for privilege escalation attempts.
Summary
Linux kernel developers have identified a new local privilege escalation flaw dubbed Dirty Frag, which succeeds the previously disclosed Copy Fail (CVE‑2026‑31431). The vulnerability remains unpatched and has already been exploited in the wild, allowing local users to gain elevated privileges. Dirty Frag exploits a flaw in the kernel's handling of memory fragmentation, enabling attackers to overwrite critical data structures. The flaw was reported to kernel maintainers and is expected to be fixed in an upcoming release. Until a patch is available, users should restrict local access and monitor for privilege escalation attempts. Administrators should plan to update kernels promptly once the fix is released.
Key changes
- Dirty Frag is a local privilege escalation vulnerability in the Linux kernel.
- It succeeds the Copy Fail flaw (CVE‑2026‑31431) and remains unpatched.
- The flaw has already been exploited in the wild, allowing local users to gain elevated privileges.
- Dirty Frag exploits a memory‑fragmentation handling bug that lets attackers overwrite critical kernel data structures.
- Kernel maintainers have been notified and a fix is expected in an upcoming release.
- Until patched, users should restrict local access and monitor for privilege escalation attempts.