CopyFail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500): The Linux Kernel LPE Chain Every SOC Needs to Know

TL;DR

CopyFail (CVE-2026-31431) is a deterministic logic flaw in the kernel's algif_aead module that lets a local attacker corrupt the page cache of any readable file, including setuid binaries, and escalate to root with a 732-byte Python script and no disk writes. Dirty Frag (CVE-2026-43284 and CVE-2026-43500) is a second chain disclosed a week later that exploits the esp4/esp6 and rxrpc subsystems instead, so it works even when the algif_aead mitigation is correctly applied. Both are actively exploited, both have public PoCs, and the widely circulated modprobe blacklist for CopyFail does not work on RHEL-family distributions because the module is compiled into the kernel. Patch both chains and verify both independently.

What this is

CopyFail is a logic flaw, not a race condition, in the Linux kernel's algif_aead module, part of the AF_ALG userspace cryptographic API. The bug lives in how the authencesn cryptographic template handles scatter-gather lists during in-place AEAD (Authenticated Encryption with Associated Data) decryption. It was disclosed on April 29, 2026, discovered by Taeyang Lee and Theori / Xint Code, carries a CVSS score of 7.8 (High), and has been added to CISA's Known Exploited Vulnerabilities catalog.

Dirty Frag is a two-CVE chain disclosed on May 7, 2026 by Hyunwoo Kim (@v4bel). CVE-2026-43284 affects the esp4/esp6 modules, the kernel's implementation of ESP (Encapsulating Security Protocol) used for IPsec. CVE-2026-43500 affects the rxrpc module, the protocol underlying AFS (Andrew File System). One research team referred to it as "CopyFail2" because a working exploit was reverse-engineered directly from the upstream fix commit.

A 732-byte Python script. Zero race conditions. 100% reliability. No disk writes, no kernel symbols, no recompilation. And it works on virtually every major Linux distribution built since 2017. That's CopyFail — and one week after it made headlines, a second, even harder-to-mitigate vulnerability called Dirty Frag proved that blocking CopyFail's fix does nothing to stop it.

Why it matters

CopyFail's combination of attributes is what makes it exceptional even among kernel LPE bugs. It is reliable, with a 100% success rate and no race condition. It is portable, working across nearly every mainstream distribution: Ubuntu, RHEL, Amazon Linux, Debian, Arch, Fedora, Rocky, Alma, Oracle, SUSE, CloudLinux, and embedded builds. It is low-noise, because zero disk writes means File Integrity Monitoring tools see nothing. And it has existed silently since roughly 2017, nearly nine years of exposure before disclosure.

Dirty Frag matters because it defeats the first-response mitigation most teams applied for CopyFail. It can be triggered whether or not the algif_aead module is available, so systems where administrators correctly applied the CopyFail mitigation — module blacklisted, initcall_blacklist set, verified — remain fully exposed. Impact also extends further in containerized environments: on hosts that don't run container workloads, successful exploitation elevates a local user directly to root, while in container deployments running arbitrary third-party workloads, Dirty Frag may additionally enable container escape. Microsoft's security team has documented active, if limited, in-the-wild exploitation attempts and notes that Dirty Frag is particularly relevant for post-compromise escalation.

How it works

CopyFail (CVE-2026-31431)

An attacker opens an AF_ALG socket and binds to the authencesn algorithm, often nested inside pcrypt(authencesn(...)) to bypass naive mitigations. Using sendmsg() combined with splice(), the attacker performs an operation where the kernel incorrectly treats source and destination page mappings as identical during an in-place AEAD decryption, when they are not. This corrupts the page cache of a file the attacker has only read access to, not write access.

The result is a deterministic, four-byte-at-a-time write primitive into the page cache of any readable file. Point that primitive at a setuid binary — /usr/bin/su is the canonical target — overwrite it with shellcode while it sits in the page cache, execute it, and the attacker is root. No timing window, no retries, no kernel symbol leaks needed. The published exploit is a 732-byte, standard-library-only Python script (Python 3.10+) that works across x86-64, AArch64, i386, and ARMv7 with architecture-specific shellcode payloads of 160, 172, 126, and 138 bytes respectively.

Dirty Frag (CVE-2026-43284, CVE-2026-43500)

Both flaws share the same root cause pattern: when a socket buffer carries paged fragments that are not privately owned by the kernel — for example, pipe pages attached via splice(2), sendfile(2), or MSG_SPLICE_PAGES — the kernel's receive path performs in-place decryption directly over those externally-backed pages. This exposes or corrupts plaintext data that an unprivileged userspace process still holds a reference to, enabling the same page-cache corruption technique CopyFail used, but through IPsec and AFS networking paths rather than the userspace crypto API.

Like CopyFail, this is a deterministic logic bug, not a race condition: no timing window is required, the kernel doesn't panic on a failed attempt, and the success rate is very high across affected distributions — Ubuntu (all releases, including 24.04.4), RHEL 10.1, openSUSE Tumbleweed, CentOS Stream, and every supported AlmaLinux release. Exploitation typically requires elevated capabilities such as CAP_NET_ADMIN, which makes it somewhat less likely in hardened, default-seccomp Kubernetes environments, but the risk remains significant for virtual machines, bare-metal hosts, and less restricted container configurations, particularly those already running IPsec/VPN or AFS-adjacent networking workloads.

A growing bug class

Security researchers have explicitly drawn a lineage between these vulnerabilities and earlier, infamous Linux kernel bugs: Dirty Cow (CVE-2016-5195, race-condition-based and often unreliable) and Dirty Pipe (CVE-2022-0847, constrained in where it could write). CopyFail and Dirty Frag represent a more dangerous evolution: deterministic, unconstrained page-cache write primitives with near-perfect reliability and no race window. Microsoft has documented a subsequent variant named Fragnesia (CVE-2026-46300), and JFrog has published research into a related flaw tracked as CVE-2026-43503 ("DirtyC...").

Detection and response

The hypothesis to test is whether a host is running a vulnerable kernel and whether the interim mitigations for both chains are actually in place and effective. The evidence that confirms or rejects it comes from the kernel version, the loaded modules, and the boot parameters, not from a disk-based file hash.

Conventional vulnerability scanners can identify a vulnerable kernel version, but they cannot reliably detect active exploitation, because the attack technique leaves minimal forensic footprint. What to look for:

Process activity: unexpected processes opening AF_ALG sockets (socket(AF_ALG, ...)) or binding to authencesn, pcrypt, ESP, or RxRPC algorithm families from unprivileged user contexts. Unusual splice() or sendmsg() syscall patterns targeting file descriptors associated with setuid binaries.

File integrity anomalies: because the attack corrupts the page cache, not the on-disk file, traditional File Integrity Monitoring (FIM) tools that check on-disk hashes will show no changes. The exploit is invisible to disk-based FIM by design. Detection requires runtime or memory-aware tooling or kernel-level monitoring (eBPF-based detection, auditd rules watching AF_ALG socket creation) rather than filesystem-based integrity checks.

Privilege escalation signals: unexpected su, sudo, or setuid binary executions immediately following anomalous socket or splice activity from a previously unprivileged session; new root-owned processes spawned from sessions that authenticated as a low-privilege user.

Network subsystem anomalies (Dirty Frag specific): unusual IPsec/ESP or AFS/RxRPC socket activity from processes that have no legitimate reason to interact with those subsystems, especially combined with splice(2), sendfile(2), or MSG_SPLICE_PAGES usage.

What to do

1. Inventory every Linux host. Include cloud instances, on-prem servers, Kubernetes nodes, CI/CD runners, and the forgotten VM that never made it into the primary patch management inventory.

2. Check the kernel version against the vulnerable ranges. CopyFail affects kernels from roughly 2017 onward. Dirty Frag affects ESP since roughly 2017 and RxRPC since roughly 2023.

3. Apply the CopyFail interim mitigation correctly for your distribution. On RHEL, CentOS, AlmaLinux, Rocky Linux, and CloudLinux, algif_aead is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y), so the modprobe blacklist runs without error but leaves the system unprotected. Use the boot parameter instead:

grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot
cat /proc/cmdline | grep initcall_blacklist   # verify

On distributions where the module is loadable, the standard mitigation applies:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

4. Apply the Dirty Frag interim mitigation separately. Blacklist all three vulnerable modules:

# /etc/modprobe.d/dirtyfrag.conf
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false

5. Verify no vulnerable modules are currently loaded, and unload them if present:

lsmod | egrep '^(esp4|esp6|rxrpc)'
rmmod esp4
rmmod esp6
rmmod rxrpc

6. Weigh the operational impact before disabling ESP and RxRPC. Disabling esp4, esp6, and rxrpc will break IPsec VPN connectivity and AFS file system access on any host that depends on them. Environments running site-to-site VPNs, IPsec-based network security, or AFS storage should prioritize the permanent kernel patch over extended reliance on the module blacklist.

7. Upgrade to a patched kernel. The permanent fix for CopyFail is a patched kernel (6.18 and later mainline, with vendor-specific patched builds rolling out per distribution). The permanent fixes for Dirty Frag are in mainline: the ESP fix landed at commit f4c50a4034e6, and the RxRPC fix at aa54b1d27fe0. Vendor kernel packages incorporating these fixes have been released by Ubuntu and other major distributions. Once applied, the modprobe-based mitigation is no longer necessary and normal ESP/RxRPC functionality is restored.

8. Prioritize Kubernetes nodes and CI/CD runners exposed to untrusted workloads first. These are the highest-value, highest-exposure targets for local-access-turned-privilege-escalation attacks.

9. In containerized environments, consider a BPF LSM policy that blocks all AF_ALG AEAD binds. This provides zero-reboot remediation and closes bypass routes via crypto template nesting.

FAQ

Does the CopyFail mitigation protect me from Dirty Frag? No. Dirty Frag can be triggered whether or not the algif_aead module is available. Systems where administrators correctly applied the CopyFail mitigation — module blacklisted, initcall_blacklist set, verified — remain fully exposed to Dirty Frag, because it exploits a completely separate code path.

Why doesn't the modprobe blacklist work on RHEL-family systems? On RHEL, CentOS, AlmaLinux, Rocky Linux, and CloudLinux, algif_aead is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y), so the blacklist commands run without error but leave the system completely unprotected. The correct mitigation on these systems is the initcall_blacklist=algif_aead_init boot parameter.

Will disabling esp4, esp6, and rxrpc break anything? Yes. Disabling these modules will break IPsec VPN connectivity and AFS file system access on any host that depends on them. Environments running site-to-site VPNs, IPsec-based network security, or AFS storage need to weigh this operational impact against the exploitation risk, and should prioritize the permanent kernel patch over extended reliance on the module blacklist.

Why don't my File Integrity Monitoring tools detect this? Because the attack corrupts the page cache, not the on-disk file. Traditional FIM tools that check on-disk hashes will show no changes. The exploit is invisible to disk-based FIM by design. Detection requires runtime or memory-aware tooling or kernel-level monitoring, such as eBPF-based detection or auditd rules watching AF_ALG socket creation.

Does CopyFail affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH? The CopyFail workaround does not affect those subsystems. They don't depend on the vulnerable AF_ALG path.

Is Dirty Frag harder to exploit than CopyFail? Exploitation of Dirty Frag typically requires elevated capabilities such as CAP_NET_ADMIN, which makes it somewhat less likely in hardened, default-seccomp Kubernetes environments. The risk remains significant for virtual machines, bare-metal hosts, and less restricted container configurations, particularly those already running IPsec/VPN or AFS-adjacent networking workloads.

Are more variants expected? Yes. Microsoft has documented a subsequent variant named Fragnesia (CVE-2026-46300), and JFrog has published research into a related flaw tracked as CVE-2026-43503 ("DirtyC..."). Treat CopyFail and Dirty Frag not as isolated incidents but as the first two confirmed members of an ongoing family of page-cache-corruption kernel vulnerabilities.

Where this fits in a program

CopyFail and Dirty Frag are exactly the kind of pair that manual, quarterly patch cycles cannot keep pace with: two related but distinct CVEs, disclosed a week apart, where the fix for one provides zero protection against the other. An attack surface inventory that covers every Linux host, plus validation so a scanner hit is not treated as proof of exploitability, is what keeps a mitigation applied for one chain from creating false confidence about the other. Trusteed continuously tracks kernel-level exposure across your infrastructure.

Sources

• Trusteed vulnerability scanner
• Trusteed asset discovery
• Trusteed continuous, change-triggered scanning
• Start scanning for free
• Talk to an expert
• Trusteed Blog