Dirtyfrag is a privilege escalation exploit that chains two Linux kernel vulnerabilities to obtain root access on major distributions.
The tool exploits a vulnerability class extending Dirty Pipe and Copy Fail by chaining the xfrm-ESP Page-Cache Write vulnerability with the RxRPC Page-Cache Write vulnerability. Unlike exploits relying on race conditions, Dirtyfrag operates as a deterministic logic bug requiring no timing window, resulting in high success rates and avoiding kernel panics on failure. The exploit works by manipulating page cache writes through these two kernel subsystems to escalate privileges.
Dirtyfrag is relevant for security researchers, penetration testers, and system administrators assessing Linux kernel security on their infrastructure. It applies to systems running affected kernel versions across major distributions including Ubuntu, RHEL, openSUSE, CentOS Stream, AlmaLinux, and Fedora. The README emphasizes that the exploit should only be used on systems you are authorized to test and notes that running it contaminates the page cache, requiring either manual cache clearing or a system reboot to restore stability.
The project maintains a detailed technical write-up documenting the vulnerability discovery, exploitation mechanics, and disclosure timeline. The README includes specific kernel commit ranges identifying affected versions and lists tested distribution versions demonstrating broad applicability across contemporary Linux systems.
