Signal
Dirty Frag: new unpatched Linux local privilege escalation vulnerability delivers root access
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-05-08 02:58 UTCUpdated 2026-05-08 16:28 UTC
rss
cvelinuxlocal_privilege_escalationvulnerabilityexploitsecurity_advisory
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (4 domains)domains are deduped. counts indicate coverage, not truth.4 top sources shown
Overview
A new Linux local privilege escalation vulnerability named Dirty Frag has been disclosed, following shortly after the Copy Fail flaw.
Entities
Amazon Web ServicesCERT BelgiumAusCERTLinux kernelHyunwoo Kim
Score total
1.75
Momentum 24h
7
Posts
7
Origins
7
Source types
1
Duplicate ratio
0%
Why now
- Dirty Frag was disclosed shortly after Copy Fail, highlighting ongoing Linux kernel security challenges.
- A public exploit is available with no current patch for the RxRPC flaw, increasing urgency.
- Major security organizations including AWS and CERT Belgium have issued advisories urging immediate action.
Why it matters
- Dirty Frag enables attackers to gain root access on all major Linux distributions, risking full system compromise.
- No patches currently exist for one of the two vulnerabilities exploited, leaving many systems exposed.
- The exploit is reliable and does not cause kernel crashes, increasing the risk of undetected attacks.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: high
Recurring claims
- Dirty Frag is a local privilege escalation vulnerability in the Linux kernel that allows unprivileged users to gain root access.
- Dirty Frag exploits two Linux kernel flaws: a patched xfrm-ESP vulnerability and an unpatched RxRPC vulnerability, with no current patches for the latter.
- The Dirty Frag exploit is deterministic, does not require race conditions, and has a high success rate without causing kernel panics on failure.
How sources frame it
- Help Net Security: neutral
- The Register Security: neutral
- AWS Security Bulletins: neutral
All evidence
All evidence
Warning: Dirty Frag, a new Linux Local Privilege Escalation vulnerability, was disclosed. Patch Immediately!
CERT.BE (BE) - Advisories · ccb.belgium.be · 2026-05-08 16:28 UTC
Dirty Frag: Unpatched Linux vulnerability delivers root access
Help Net Security · helpnetsecurity.com · 2026-05-08 14:13 UTC
'Dirty Frag' Linux flaw one-ups CopyFail with no patches and public root exploit
The Register Security · theregister.com · 2026-05-08 13:36 UTC
Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
SANS Internet Storm Center (Handler's Diary) · isc.sans.edu · 2026-05-08 07:50 UTC
Linux Kernel Dirty Frag LPE Exploit Enables Root Access Across Major Distributions
thehackernews · thehackernews.com · 2026-05-08 05:12 UTC
Linux Kernel: CVSS (Max): None
AusCERT - Bulletins · portal.auscert.org.au · 2026-05-08 03:19 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 6Origin domains: 6Duplicates: -
Showing 6 / 0
Top publishers (this list)
- CERT.BE (BE) - Advisories (1)
- Help Net Security (1)
- The Register Security (1)
- SANS Internet Storm Center (Handler's Diary) (1)
- thehackernews (1)
- AusCERT - Bulletins (1)
Top origin domains (this list)
- ccb.belgium.be (1)
- helpnetsecurity.com (1)
- theregister.com (1)
- isc.sans.edu (1)
- thehackernews.com (1)
- portal.auscert.org.au (1)