CopyFail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500): The Linux Kernel LPE Chain Every SOC Needs to Know

A 732-byte Python script. Zero race conditions. 100% reliability. No disk writes, no kernel symbols, no recompilation. And it works on virtually every major Linux distribution built since 2017. That's CopyFail — and one week after it made headlines, a second, even harder-to-mitigate vulnerability called Dirty Frag proved that blocking CopyFail's fix does nothing to stop it.

If your infrastructure runs Linux — and if you're reading this, it almost certainly does — CVE-2026-31431 ("CopyFail"), CVE-2026-43284, and CVE-2026-43500 (together, "Dirty Frag") are the three CVE identifiers that should be at the top of your patch queue right now. This post gives you the technical breakdown, the exploitation mechanics, the indicators of compromise, and the mitigation guidance for both vulnerability chains — plus why the standard advice for one doesn't protect you from the other.

---

Quick Reference: What You Need to Know Right Now

	CopyFail	Dirty Frag
CVE ID(s)	CVE-2026-31431	CVE-2026-43284 (ESP), CVE-2026-43500 (RxRPC)
CVSS Score	7.8 (High)	High severity, chained pair
Disclosed	April 29, 2026	May 7, 2026
Discovered by	Taeyang Lee & Theori / Xint Code	Hyunwoo Kim (@v4bel)
Affected component	algif_aead (AF_ALG crypto interface, authencesn)	esp4/esp6 (IPsec) and rxrpc (AFS) subsystems
Vulnerable since	Kernels from ~2017 onward	ESP since ~2017, RxRPC since ~2023
Impact	Local privilege escalation to root	Local privilege escalation to root; container escape in some configs
CISA KEV	Yes — actively exploited	Being tracked; active exploitation monitored by Microsoft
Public exploit	Yes, multiple PoCs (Python, multi-arch)	Yes, public PoC
Fix available	Yes — patched kernels rolling out per distro	Yes — mainline patched; vendor rollout ongoing

The critical fact that connects them: Dirty Frag can be exploited regardless of whether the algif_aead module is disabled. If your team applied the widely-circulated CopyFail mitigation and considered the issue closed, you are still exposed to Dirty Frag through a completely different kernel subsystem.

---

CopyFail (CVE-2026-31431): How It Works

CopyFail is a logic flaw — not a race condition — in the Linux kernel's algif_aead module, part of the AF_ALG userspace cryptographic API. The bug lives in how the authencesn cryptographic template handles scatter-gather lists during in-place AEAD (Authenticated Encryption with Associated Data) decryption.

The Technical Mechanism

An attacker opens an AF_ALG socket and binds to the authencesn algorithm (often nested inside pcrypt(authencesn(...)) to bypass naive mitigations). Using sendmsg() combined with splice(), the attacker performs an operation where the kernel incorrectly treats source and destination page mappings as identical during an "in-place" AEAD decryption — when they are not. This corrupts the page cache of a file the attacker has only read access to, not write access.

The result is a deterministic, four-byte-at-a-time write primitive into the page cache of any readable file. Point that primitive at a setuid binary — /usr/bin/su is the canonical target — overwrite it with shellcode while it sits in the page cache (no actual disk write occurs), execute it, and the attacker is root. No timing window. No retries. No kernel symbol leaks needed.

The published exploit is remarkably compact: a 732-byte, standard-library-only Python script (Python 3.10+) that works across x86-64, AArch64, i386, and ARMv7 with architecture-specific shellcode payloads (160, 172, 126, and 138 bytes respectively).

Why It's So Dangerous

CopyFail's combination of attributes is what makes it exceptional even among kernel LPE bugs: it's reliable (100% success rate, no race condition), portable (works across nearly every mainstream distribution — Ubuntu, RHEL, Amazon Linux, Debian, Arch, Fedora, Rocky, Alma, Oracle, SUSE, CloudLinux, embedded builds), low-noise (zero disk writes means File Integrity Monitoring tools see nothing), and it has existed silently since roughly 2017 — nearly nine years of exposure before disclosure. CISA has added it to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild.

Mitigation: The Trap Most Teams Fall Into

The widely-circulated first-response mitigation — blacklisting the algif_aead module via /etc/modprobe.d/ — does not work on RHEL, CentOS, AlmaLinux, Rocky Linux, or CloudLinux. On these distributions, algif_aead is compiled directly into the kernel (CONFIG_CRYPTO_USER_API_AEAD=y), so the blacklist commands run without error but leave the system completely unprotected.

The correct mitigation for RHEL-family systems:

grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot
cat /proc/cmdline | grep initcall_blacklist   # verify

For distributions where the module is loadable, the standard mitigation applies:

echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true

This workaround does not affect dm-crypt/LUKS, kTLS, IPsec/XFRM, OpenSSL, GnuTLS, NSS, or SSH — those subsystems don't depend on the vulnerable AF_ALG path. In containerized environments, a BPF LSM policy that blocks all AF_ALG AEAD binds provides zero-reboot remediation and closes bypass routes via crypto template nesting. The permanent fix is upgrading to a patched kernel (6.18 and later mainline, with vendor-specific patched builds rolling out per distribution) — as of early disclosure, no distribution had yet shipped a fixed kernel package, making interim mitigation mandatory, not optional.

Priority order for remediation: Kubernetes nodes and CI/CD runners exposed to untrusted workloads first — these are the highest-value, highest-exposure targets for local-access-turned-privilege-escalation attacks.

---

Dirty Frag (CVE-2026-43284, CVE-2026-43500): The Successor That Bypasses CopyFail's Fix

One week after CopyFail's disclosure, researcher Hyunwoo Kim (@v4bel) published a second Linux kernel vulnerability chain in an entirely different subsystem — but built on the same underlying bug class. It was named "Dirty Frag," and one research team subsequently referred to it as "CopyFail2" because a working exploit was reverse-engineered directly from the upstream fix commit.

The Technical Mechanism

Dirty Frag chains two distinct kernel bugs, each with its own CVE. CVE-2026-43284 affects the esp4/esp6 modules — the kernel's implementation of ESP (Encapsulating Security Protocol), used for IPsec. CVE-2026-43500 affects the rxrpc module — the protocol underlying AFS (Andrew File System).

Both flaws share the same root cause pattern: when a socket buffer carries paged fragments that are not privately owned by the kernel — for example, pipe pages attached via splice(2), sendfile(2), or MSG_SPLICE_PAGES — the kernel's receive path performs in-place decryption directly over those externally-backed pages. This exposes or corrupts plaintext data that an unprivileged userspace process still holds a reference to, enabling the same page-cache corruption technique CopyFail used — but through IPsec and AFS networking paths rather than the userspace crypto API.

Like CopyFail, this is a deterministic logic bug, not a race condition: no timing window is required, the kernel doesn't panic on a failed attempt, and the success rate is very high across affected distributions — Ubuntu (all releases, including 24.04.4), RHEL 10.1, openSUSE Tumbleweed, CentOS Stream, and every supported AlmaLinux release.

Why Dirty Frag Is Harder to Contain Than CopyFail

This is the detail that matters most for incident response teams: Dirty Frag can be triggered whether or not the algif_aead module is available. Systems where administrators correctly applied the CopyFail mitigation — module blacklisted, initcall_blacklist set, verified — remain fully exposed to Dirty Frag, because it exploits a completely separate code path.

Impact also extends further than CopyFail in containerized environments. On hosts that don't run container workloads, successful exploitation elevates a local user directly to root. In container deployments running arbitrary third-party workloads, Dirty Frag may additionally enable container escape, expanding the blast radius from a single-host compromise to broader infrastructure risk. Microsoft's security team has documented active, if limited, in-the-wild exploitation attempts and notes that Dirty Frag is particularly relevant for post-compromise escalation — attackers who've already gained low-privilege access via SSH, a web shell, a compromised container, or a low-privileged account can use Dirty Frag to escalate to full root control.

One practical limiting factor: exploitation of Dirty Frag typically requires elevated capabilities such as CAP_NET_ADMIN, which makes it somewhat less likely in hardened, default-seccomp Kubernetes environments — but the risk remains significant for virtual machines, bare-metal hosts, and less restricted container configurations, particularly those already running IPsec/VPN or AFS-adjacent networking workloads.

Mitigation

Until vendor-patched kernels are fully deployed, the interim mitigation blacklists all three vulnerable modules:

# /etc/modprobe.d/dirtyfrag.conf
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false

Verify no vulnerable modules are currently loaded, and unload them if present:

lsmod | egrep '^(esp4|esp6|rxrpc)'
rmmod esp4
rmmod esp6
rmmod rxrpc

The permanent fixes are in mainline: the ESP fix landed at commit f4c50a4034e6, and the RxRPC fix at aa54b1d27fe0. Vendor kernel packages incorporating these fixes have been released by Ubuntu and other major distributions — once applied, the modprobe-based mitigation is no longer necessary and normal ESP/RxRPC functionality is restored.

Important caveat: disabling esp4, esp6, and rxrpc will break IPsec VPN connectivity and AFS file system access on any host that depends on them. Environments running site-to-site VPNs, IPsec-based network security, or AFS storage need to weigh this operational impact against the exploitation risk, and should prioritize the permanent kernel patch over extended reliance on the module blacklist.

---

A Growing Bug Class: What Comes After Dirty Frag

Security researchers have explicitly drawn a lineage between these vulnerabilities and earlier, infamous Linux kernel bugs: Dirty Cow (CVE-2016-5195, race-condition-based and often unreliable) and Dirty Pipe (CVE-2022-0847, constrained in where it could write). CopyFail and Dirty Frag represent a more dangerous evolution — deterministic, unconstrained page-cache write primitives with near-perfect reliability and no race window.

This bug class is still active. Microsoft has documented a subsequent variant named Fragnesia (CVE-2026-46300), and JFrog has published research into a related flaw tracked as CVE-2026-43503 ("DirtyC..."). Treat CopyFail and Dirty Frag not as isolated incidents but as the first two confirmed members of an ongoing family of page-cache-corruption kernel vulnerabilities. Organizations should expect additional variants targeting other kernel subsystems that perform in-place operations over externally-backed pages.

---

Indicators of Compromise and Detection Challenges

Both vulnerabilities share a detection problem that makes them especially dangerous: conventional vulnerability scanners can identify a vulnerable kernel version, but they cannot reliably detect active exploitation, because the attack technique leaves minimal forensic footprint.

What to look for:

Process activity: unexpected processes opening AF_ALG sockets (socket(AF_ALG, ...)) or binding to authencesn, pcrypt, ESP, or RxRPC algorithm families from unprivileged user contexts. Unusual splice() or sendmsg() syscall patterns targeting file descriptors associated with setuid binaries.

File integrity anomalies: because the attack corrupts the page cache, not the on-disk file, traditional File Integrity Monitoring (FIM) tools that check on-disk hashes will show no changes — the exploit is invisible to disk-based FIM by design. Detection requires runtime/memory-aware tooling or kernel-level monitoring (eBPF-based detection, auditd rules watching AF_ALG socket creation) rather than filesystem-based integrity checks.

Privilege escalation signals: unexpected su, sudo, or setuid binary executions immediately following anomalous socket or splice activity from a previously unprivileged session; new root-owned processes spawned from sessions that authenticated as a low-privilege user.

Network subsystem anomalies (Dirty Frag specific): unusual IPsec/ESP or AFS/RxRPC socket activity from processes that have no legitimate reason to interact with those subsystems, especially combined with splice(2)/sendfile(2)/MSG_SPLICE_PAGES usage.

---

How Trusteed Helps You Verify and Remediate Before Attackers Do

CopyFail and Dirty Frag are exactly the kind of vulnerability pair that manual, quarterly patch cycles cannot keep pace with: two related but distinct CVEs, disclosed a week apart, where the fix for one provides zero protection against the other, both with public, reliable, low-footprint exploits already circulating.

Trusteed's vulnerability scanner continuously identifies affected kernel versions across your entire infrastructure — cloud instances, on-prem servers, Kubernetes nodes, and CI/CD runners — and flags exposure to both CVE-2026-31431 and the CVE-2026-43284/CVE-2026-43500 pair independently, so a mitigation applied for one doesn't create false confidence about the other. Asset discovery ensures you know about every Linux host in your environment, including the forgotten VM or CI runner that never made it into the primary patch management inventory. And because these vulnerabilities are actively exploited and rapidly evolving into new variants, continuous, change-triggered scanning catches newly provisioned hosts and re-validates previously mitigated systems as new variants like Fragnesia emerge — rather than waiting for the next scheduled scan cycle to discover you're exposed again.

---

Patch Both. Verify Both. Don't Assume One Fix Covers the Other.

CopyFail and Dirty Frag are a case study in why kernel-level local privilege escalation deserves urgent attention even when it "just" requires local access — because local access is exactly what attackers get first, through phishing, web shells, compromised containers, or low-privilege credential theft, and vulnerabilities like these are what turn that initial foothold into full root compromise.

The single most important operational takeaway: these are two separate vulnerability chains in two separate kernel subsystems. Confirming your algif_aead mitigation for CopyFail tells you nothing about your exposure to Dirty Frag's ESP and RxRPC paths. Both need to be checked, both need to be mitigated, and both need permanent kernel patches applied as soon as your distribution ships them.

---

Ready to verify your Linux fleet against CopyFail and Dirty Frag? Start scanning for free or talk to an expert to see how Trusteed continuously tracks kernel-level exposure across your entire infrastructure.

---

This post was published on the Trusteed Blog. Trusteed provides always-on agentic CTEM — continuous vulnerability scanning, asset discovery, and exploitability-aware prioritization — helping teams verify and remediate actively exploited vulnerabilities like CopyFail and Dirty Frag before attackers do.