New Linux 'Dirty Frag' Zero-Day Gives Root On All Major Distros

Source: Slashdot

Overview

Dirty Frag is a newly disclosed vulnerability class, first discovered and reported by Hyunwoo Kim (@v4bel). It enables root‑level privilege escalation on major Linux distributions by chaining two separate page‑cache write bugs:

• xfrm‑ESP Page‑Cache Write vulnerability
• RxRPC Page‑Cache Write vulnerability

Dirty Frag extends the bug family that includes Dirty Pipe and Copy Fail. Unlike many exploits that rely on timing windows, Dirty Frag is a deterministic logic bug—no race condition is required, the kernel does not panic on failure, and the success rate is very high.

Technical Details

• The exploit combines the two page‑cache write vulnerabilities to achieve root access.
• Because the bug is deterministic, it works reliably across all major Linux distributions.
• At the time of disclosure, no patches or CVE identifiers had been issued.

CVE Tracking

BleepingComputer reports that the individual vulnerabilities are now tracked under the following CVE IDs:

References

• Detailed technical information can be found [here].
• Original report shared by mrspoonsi.
• BleepingComputer coverage of the CVE assignments.