# Another vulnerability that gives root access: dirty-frag (FIXED with Linux kernel 7.0.6 Update \[finally\]) **URL:** \ **Category:** Kernel, boot, graphics & hardware\ **Created:** [May 8, 2026, 12:33am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530 "2026-05-08T00:33:36Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![archisman](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archisman/32/44491_2.png) [@archisman](https://forum.endeavouros.com/u/archisman)\ **Post date:** [May 8, 2026, 12:33am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/1 "2026-05-08T00:33:36Z")
After the copy-fail vulnerability, another new vulnerability was found recently. This allows a regular user to become root without the password (which means, any random program can successfully run a root command). See [https://www.openwall.com/lists/oss-security/2026/05/07/8](https://www.openwall.com/lists/oss-security/2026/05/07/8) and [https://github.com/V4bel/dirtyfrag](https://github.com/V4bel/dirtyfrag) Some kernels in Arch are affected: [https://github.com/V4bel/dirtyfrag/issues/6](https://github.com/V4bel/dirtyfrag/issues/6) ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [May 8, 2026, 12:51am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/2 "2026-05-08T00:51:31Z")
openwall: "This vulnerability has a similar impact to the previous Copy Fail. Because the embargo has now been broken, no patches or CVEs exist for these vulnerabilities. After consultation with the linux-distros@…openwall.org maintainers, and at the maintainers’ request, I am publicly releasing this Dirty Frag document. As with the previous Copy Fail vulnerability, Dirty Frag likewise allows immediate root privilege escalation on all major distributions, and it chains two separate vulnerabilities" WTH does “the embargo has now been broken” mean? a chain of custody thing? In light of the Global Canvas .edu ransomware fiasco where ShinyObjects or whatever its called claims 275 million PII-breached students, teachers, and admins around the world and has literally stopped all online learning around the world at most colleges and unis… ..in light of copy/fail… ..in light of massive DDOS on arch/UBU …there’s more I’m missing including ‘Iranian’ hacks etc Digitally, May really feels like (cyber) war for some reason…and it just started… ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [May 8, 2026, 12:52am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/3 "2026-05-08T00:52:35Z")
This is the mitigation being shared by most sources: > # Mitigation > > 1. Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution. Use the following command to remove the modules in which the vulnerabilities occur. > > ```auto > sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" > > ``` > > 1. Once each distribution backports a patch, update accordingly. This will unload (`rmmod`) and disable three modules: - `esp4` - IPsec ESP for IPv4 (xfrm subsystem) - `esp6` - IPsec ESP for IPv6 (xfrm subsystem) - `rxrpc` - RxRPC protocol (used by AFS) So if you’re currently depending on IPsec, maybe first consider your options before running the proposed mitigation. ---
**Author:** ![smokey](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/smokey/32/133678_2.png) [@smokey](https://forum.endeavouros.com/u/smokey)\ **Post date:** [May 8, 2026, 5:02am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/4 "2026-05-08T05:02:19Z")
[![](https://img.youtube.com/vi/Q6gdCTNI4mo/maxresdefault.jpg "New Linux Exploit Just Dropped (Before the Fix)") ](https://www.youtube.com/watch?v=Q6gdCTNI4mo) Here is a video on it ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 8, 2026, 6:33am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/5 "2026-05-08T06:33:20Z")
> [@Bink](#): > > This is the mitigation being shared by most sources: > > > # Mitigation > > > > 1. Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution. Use the following command to remove the modules in which the vulnerabilities occur. > > > > ```auto > > sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" > > > > ``` > > > > 1. Once each distribution backports a patch, update accordingly. > > This will unload (`rmmod`) and disable three modules: > > - `esp4` - IPsec ESP for IPv4 (xfrm subsystem) > - `esp6` - IPsec ESP for IPv6 (xfrm subsystem) > - `rxrpc` - RxRPC protocol (used by AFS) > > So if you’re currently depending on IPsec, maybe first consider your options before running the proposed mitigation. Just hold on a minute. This will disable IPSec for IPv4 and IPv6. How will VPNs work after this? Embargo period is typically 60-90 days when the exploit is first disclosed to the original developers and they have time to fix this. So there has been no fix for this til now? Are you sh\*\*\*\*ng me? ---
**Author:** ![smokey](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/smokey/32/133678_2.png) [@smokey](https://forum.endeavouros.com/u/smokey)\ **Post date:** [May 8, 2026, 6:37am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/6 "2026-05-08T06:37:05Z")
> [@Archie1](#): > > Embargo period is typically 60-90 days when the exploit is first disclosed to the original developers and they have time to fix this The embargo period was accidentally broken from my understanding ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [May 8, 2026, 6:37am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/7 "2026-05-08T06:37:16Z")
Yeah VPN’s using IPsec will have an issue. There are other protocols, but sometimes one is at the mercy of corporate IT departments. If those departments are using Linux, I imagine this would get their attention at least. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 8, 2026, 6:48am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/8 "2026-05-08T06:48:01Z")
VPNs using IPSec are the majority out there. This is going to be huge. Seriously Linux Kernel needs to be broken up into a more modular setup. About the RxRPC, disabling that impacts the Andrew File System (AFS). Beyond that it should not impact anything else. So that should be small. IPSec is typically part of the `strongswan` package. If that is not installed then also the vulnerability exists? ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 8, 2026, 7:14am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/9 "2026-05-08T07:14:32Z")
> [@smokey](#): > > [https://www.youtube.com/watch?v=Q6gdCTNI4mo](https://www.youtube.com/watch?v=Q6gdCTNI4mo) > > Here is a video on it The video does not list Arch. So does that mean Arch Linux Kernels are safe? ---
**Author:** ![smokey](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/smokey/32/133678_2.png) [@smokey](https://forum.endeavouros.com/u/smokey)\ **Post date:** [May 8, 2026, 7:16am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/10 "2026-05-08T07:16:55Z")
Pretty sure Arch is affected, you might want to just have a bit of a search to confirm it though ---
**Author:** ![Bryanpwo](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bryanpwo/32/130600_2.png) [@Bryanpwo](https://forum.endeavouros.com/u/Bryanpwo)\ **Post date:** [May 8, 2026, 8:10am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/11 "2026-05-08T08:10:27Z")
---
**Author:** ![mbod](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mbod/32/16833_2.png) [@mbod](https://forum.endeavouros.com/u/mbod)\ **Post date:** [May 8, 2026, 10:25am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/12 "2026-05-08T10:25:36Z")
kernel 7.0.5 and new versions for all LTS kernels have just been released with a fix [https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.5](https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.5) ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 8, 2026, 10:26am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/13 "2026-05-08T10:26:56Z")
everyone is effected by this, and more similar exploits to come sooner or later. As posted here: - [https://forum.manjaro.org/t/alert-dirty-frag-root-privilege-vulnerability/187451](https://forum.manjaro.org/t/alert-dirty-frag-root-privilege-vulnerability/187451) ```auto sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches' ``` will clean off caches affected in case but no warranty on that. Seems this vulnerability was leaked before anyone was able to create any real fix to close it: > Kim submitted the rxrpc patch to the netdev mailing list on April 29, 2026. The linux-distros embargo was set for May 12. An unrelated third party published the ESP exploit publicly on May 7, breaking the embargo and triggering immediate full disclosure And i do **not** recommend to run the [one-line-special](https://github.com/V4bel/dirtyfrag/#one-line-special) mentioned, it is not to test if you are effected, it is to demonstrate the vulnerability itself: ![screenshot2026-05-0815-19-27](https://forum.endeavouros.com/uploads/default/original/3X/7/c/7c30d850c38b65218b556324a79c619d68f3c9f7.png) - [https://www.openwall.com/lists/oss-security/2026/05/07/8](https://www.openwall.com/lists/oss-security/2026/05/07/8) ( **@archisman** already posted that ond) On the writeup you can fine also a disclosure-timeline: - [https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md#disclosure-timeline](https://github.com/V4bel/dirtyfrag/blob/master/assets/write-up.md#disclosure-timeline) > - 2026-05-08: The [f4c50a4034e6](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4) patch was merged into mainline. > - 2026-05-08: This vulnerability was assigned CVE-2026-43284. Just saw LTS kernel is updated already others will follow soon. **Safe Version:** ~~[6.18.28-1-lts](https://gitlab.archlinux.org/archlinux/packaging/packages/linux-lts/-/commit/f53ecd290c83238641381681c379c0668ee97342)~~ **Safe Version:** ~~[7.0.3.arch1-3](https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/commit/71219a6e1bef7d427a8aebb8b2d2c97d412f617f)~~ → > [@zero1976](#): > > Modules esp4 and esp6 have been fixed with kernel 7.0.5 (and 6.18.28) . Modul rxrpc has been fixed with 7.0.6 (and 6.18.29). > **[Linux 7.0.6 Released To Finish Mitigating the Dirty Frag Vulnerability](https://www.phoronix.com/news/Linux-7.0.6-Released)** > > Linux 7.0.6 is out as stable this morning to finish mitigating the Dirty Frag vulnerability that was made public last week. ---
**Author:** ![mbod](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mbod/32/16833_2.png) [@mbod](https://forum.endeavouros.com/u/mbod)\ **Post date:** [May 8, 2026, 10:44am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/14 "2026-05-08T10:44:09Z")
> [@joekamprad](#): > > **Safe Version:** [6.18.27-1-lts](https://www.kernel.org/pub/linux/kernel/v6.x/ChangeLog-6.18.27) (or later) Shouldnt that read: 6.18.28 ? ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 8, 2026, 10:57am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/15 "2026-05-08T10:57:21Z")
> **[upgpkg: 7.0.3.arch1-3: fix dirty frag (71219a6e) · Commits · Arch Linux /...](https://gitlab.archlinux.org/archlinux/packaging/packages/linux/-/commit/71219a6e1bef7d427a8aebb8b2d2c97d412f617f)** > > Linux packages: linux linux-headers linux-docs i find this for current kernel.. **6.18.28-1:** current latest build which includes the upstream fixes plus some final fixes .. only tried to report its still ongoing and could change i think. 6.18.27-1 was the version first submitted but only partly fixing the issue. ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 8, 2026, 11:07am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/16 "2026-05-08T11:07:27Z")
main kernel is still not reaching repos here .. so i am on LTS for the time .. ---
**Author:** ![MyNameIsRichard](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mynameisrichard/32/111876_2.png) [@MyNameIsRichard](https://forum.endeavouros.com/u/MyNameIsRichard)\ **Post date:** [May 8, 2026, 11:20am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/17 "2026-05-08T11:20:36Z")
I’m keeping an eye on the main kernel update. If it hasn’t arrived before my next break, I’ll reboot into the lts. That’s about 10 minutes. ---
**Author:** ![joekamprad](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/joekamprad/32/77608_2.png) [@joekamprad](https://forum.endeavouros.com/u/joekamprad)\ **Post date:** [May 8, 2026, 11:22am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/18 "2026-05-08T11:22:21Z")
hmm germany slow on syncing 😉 ---
**Author:** ![MyNameIsRichard](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mynameisrichard/32/111876_2.png) [@MyNameIsRichard](https://forum.endeavouros.com/u/MyNameIsRichard)\ **Post date:** [May 8, 2026, 11:25am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/19 "2026-05-08T11:25:24Z")
That was me having not cleared the update widget after updating the lts. It was still the LTS 😳 ---
**Author:** ![TheRaOct](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/theraoct/32/37424_2.png) [@TheRaOct](https://forum.endeavouros.com/u/TheRaOct)\ **Post date:** [May 8, 2026, 11:40am UTC](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530/20 "2026-05-08T11:40:23Z")
> [@joekamprad](#): > > And i do not recommend to run the [one-line-special](https://github.com/V4bel/dirtyfrag/#one-line-special) mentioned. > > - [https://www.openwall.com/lists/oss-security/2026/05/07/8](https://www.openwall.com/lists/oss-security/2026/05/07/8) ( **@archisman** already posted that ond) Is this a typo, i.e. did you mean to say to run this command? If not, could you elaborate why not to run this command? (Or maybe I missed that part in the linked write-ups?) [Next page](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-6-update-finally/79530.md?page=2)