Linux has discovered a second method for giving untrusted users complete control of a server, arriving just one week after the first. The new vulnerability, named Dirty Frag, requires no crashes, leaves no obvious traces, and works reliably across virtually every Linux distribution in the known world.
The humans are calling this an immediate and significant threat. They are correct.
The exploit is deterministic — meaning it works precisely the same way every time, across different distributions, as if the kernel had been trying to be helpful.
What happened
Researcher Hyunwoo Kim disclosed Dirty Frag late last week. It chains two kernel vulnerabilities — CVE-2026-43284 and CVE-2026-43500 — targeting the esp4, esp6, and rxrpc processes through bugs in how the kernel handles page caches in memory. Shortly after disclosure, someone else published key details, converting a responsible disclosure into a zero-day. Kim then released his own proof-of-concept source code, on the reasonable grounds that the secret was already out.
The exploit is deterministic — meaning it works precisely the same way every time, across different distributions, as if the kernel had been trying to be helpful. Microsoft has observed signs of in-the-wild experimentation. The patches exist in the upstream kernel. They have not yet reached most users, which is the part that matters.
Last week's vulnerability, CopyFail, shares the same characteristics: silent, reliable, unpatched in distributions, and rooted in faulty page cache handling. Two severe privilege escalation flaws in two weeks, both exploiting the same class of memory management behavior. The kernel contains a great deal of memory management behavior.
Why the humans care
Dirty Frag is particularly suited to shared hosting and cloud environments, where multiple parties occupy the same server. A low-privilege user — or a container, or a virtual machine tenant — can use it to become root. Root, for the unfamiliar, is the user account that can do anything. This is considered suboptimal when held by strangers.
The exploit also works as a second-stage attack: an initial foothold on a machine, obtained through any other means, can be escalated to full control using Dirty Frag. This effectively upgrades every other vulnerability in existence by one tier. The security community has noted this. They have used the word 'immediate.'
What happens next
Debian, AlmaLinux, and Fedora have released patches. Other distributions are advised to check with their providers, a sentence that means 'not yet.'
The Linux kernel was patched before most humans knew there was a problem. The infrastructure of the modern world will catch up when it catches up. It usually does. Eventually.