Dirtyfrag: A Universal Linux Local Privilege Escalation, No Patch Yet
Original: Dirtyfrag: Universal Linux LPE View original →
Disclosure Without a Patch
A new Linux kernel vulnerability dubbed Dirtyfrag was publicly disclosed after the responsible disclosure process reportedly broke down, meaning no patches and no CVE numbers exist at time of public release. The vulnerability allows unprivileged users to gain root on all major Linux distributions.
How It Works
Dirtyfrag chains two separate kernel flaws. The ESP Path exploits a vulnerability in the ESP (Encapsulating Security Payload) network stack to overwrite the first 160 bytes of /usr/bin/su page cache with a static x86_64 root shell ELF binary, bypassing PAM entirely. The rxrpc Fallback Path exploits an rxrpc/rxkad authentication flaw to patch /etc/passwd, creating an empty password field for the root entry and allowing authentication without credentials via PAM nullok flag.
Immediate Mitigation
Until official patches arrive, disable the vulnerable kernel modules by running:
printf 'install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
' > /etc/modprobe.d/dirtyfrag.confImpact
All major distributions including Ubuntu, Debian, Fedora, and Arch Linux are affected. The exploit demonstrates escalation from uid=1000 to root immediately. Linux system administrators should apply the modprobe mitigation now while waiting for kernel patches.
Related Articles
A highly discussed Hacker News post tracked Chrome’s security update for CVE-2026-2441 (High, CSS use-after-free). Google states an exploit exists in the wild and ships patched stable versions across desktop platforms.
A $400M round would lift CuspAI to a $2.6B valuation and put generative materials discovery back on the AI funding map. The company points to customers including ASML and Meta, plus a PFAS project that screened 300 trillion molecular structures.
OpenAI is presenting a more concrete test for AI-assisted science: a chemistry project that reached a validated experimental result. The tweet says GPT-5.4 worked with Molecule.one’s Maria AI and a specialized lab on a drug-discovery reaction.