MONDOO-ADV-2026-up91c

Two Linux kernel page-cache write vulnerabilities — in the xfrm ESP and RxRPC subsystems — can be chained to achieve deterministic local privilege escalation to root on every major Linux distribution. The exploit, dubbed "DirtyFrag," does not rely on race conditions or timing windows and has a very high success rate.

Remediation

Patched kernels are now available from every affected vendor except SUSE Linux Enterprise 15 SP3.

1. Update the kernel and reboot. The fixed version for each distribution is listed in this advisory's affected package data, and the vendor advisories are linked in the references section. The reboot is required — the running kernel stays vulnerable until the patched one is booted.

   The upstream fix is mainline commit f4c50a4034e6 ("skb: set SKBFL_SHARED_FRAG on splice-originated frags"); distribution backports carry it as "xfrm: esp: avoid in-place decrypt on shared skb frags".

2. Where no patched kernel exists — SUSE Linux Enterprise Server 15 SP3-LTSS and SUSE Linux Enterprise Server for SAP Applications 15 SP3, which SUSE still lists as affected — apply the workarounds below instead.

Workarounds

Use these only where no patched kernel is available yet, or as a stopgap until a reboot window.

1. Blacklist the vulnerable kernel modules (recommended for most systems):

   cat <<'EOF' | sudo tee /etc/modprobe.d/dirtyfrag.conf
   install esp4 /bin/false
   install esp6 /bin/false
   install rxrpc /bin/false
   EOF
   sudo modprobe -r esp4 esp6 rxrpc 2>/dev/null || true
   

   Note: Disabling esp4/esp6 will break IPsec VPN connectivity. Disabling rxrpc will break AFS file system access. Only apply to systems that do not use these features.

2. Restrict unprivileged user namespace creation where feasible. The xfrm ESP variant requires CAP_NET_ADMIN obtained through user namespaces.

3. Deploy seccomp profiles blocking AF_RXRPC (family 33) socket creation in containers and sandboxes...