Dirtyfrag: A Universal Linux Local Privilege Escalation, No Patch Yet
Original: Dirtyfrag: Universal Linux LPE View original →
Disclosure Without a Patch
A new Linux kernel vulnerability dubbed Dirtyfrag was publicly disclosed after the responsible disclosure process reportedly broke down, meaning no patches and no CVE numbers exist at time of public release. The vulnerability allows unprivileged users to gain root on all major Linux distributions.
How It Works
Dirtyfrag chains two separate kernel flaws. The ESP Path exploits a vulnerability in the ESP (Encapsulating Security Payload) network stack to overwrite the first 160 bytes of /usr/bin/su page cache with a static x86_64 root shell ELF binary, bypassing PAM entirely. The rxrpc Fallback Path exploits an rxrpc/rxkad authentication flaw to patch /etc/passwd, creating an empty password field for the root entry and allowing authentication without credentials via PAM nullok flag.
Immediate Mitigation
Until official patches arrive, disable the vulnerable kernel modules by running:
printf 'install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
' > /etc/modprobe.d/dirtyfrag.confImpact
All major distributions including Ubuntu, Debian, Fedora, and Arch Linux are affected. The exploit demonstrates escalation from uid=1000 to root immediately. Linux system administrators should apply the modprobe mitigation now while waiting for kernel patches.
Related Articles
A highly discussed Hacker News post tracked Chrome’s security update for CVE-2026-2441 (High, CSS use-after-free). Google states an exploit exists in the wild and ships patched stable versions across desktop platforms.
OpenAI’s next major model family, Astra, is being tested through research outputs rather than only benchmarks. The company says an internal version produced 10 results and that finding them would cost roughly $2,000 at Sol API rates.
OpenAI says an internal version of Astra produced new results on 10 long-running problems in mathematics and theoretical computer science. The company released manuscripts, reasoning walkthroughs, and Lean certificates, and estimated discovery compute at about $2,000 at Sol API rates.