Executive Summary
A high-severity Linux kernel vulnerability nicknamed 'Dirty Frag' has been disclosed, enabling local attackers to gain root permissions by tampering with the page cache of read-only files. Unlike previous page cache vulnerabilities, Dirty Frag does not rely on race conditions, making exploitation highly stable and deterministic. It leverages flaws in the splice system call when combined with either the xfrm-ESP (IPsec) or RxRPC protocol stacks.
Technically, the vulnerability allows unprivileged users to overwrite memory data associated with critical system files without altering the original disk content. This bypasses many traditional disk-scanning security tools. The exploit can be triggered via simple scripts and is particularly dangerous in multi-tenant environments, such as jump servers and container clouds, where it can facilitate both local privilege escalation (LPE) and container escape.
With a CVSS score of 7.8 and public Proof-of-Concept (PoC) code already available, this threat poses an immediate risk to a wide range of Linux distributions including Ubuntu, Debian, RHEL, and CentOS. Organizations should prioritize identifying vulnerable kernel versions and consider disabling the affected modules (esp4, esp6, rxrpc) if they are not critical to operations.