Four critical LPE in two weeks of May 2026. All in the page cache Linux kernel. All - without race condition, without kernel panic, with a probability of success close to 100%. And all found with LLM.
Not some experimental code - combat exploits to obtain root shell from an ordinary user. According to FIRST.org, EPS-evaluation CVE-2026-31431 (CopyFal) is 0.9627, and CVE-2026-43284 (Dirty Frag) - 0.9324. Both in top 1% are likely to operate in a 30-day window. CopyFail is already in the CISA KEV catalog with the mark "active exploit" and patching deadline on May 15, 2026. All four vulnerabilities - direct descendants of Dirty Pipe (CVE-2022-0847): The same primitive recording in page cache through zero-copy paths, only through different kernel subsystems.
Why an attacker page-cache LPE
The essence is a replacement of the content of setuid-binary (/usr/bin/su, /usr/bin/sudo) or system files (/etc/passwd) right in RAM. The file on the disk is intact, but each appeal to it returns a poisoned copy from page cache. Root-access without recording on disk and without aerates in dmesg
On the inner pentest, the chain looks like this:
1. Initial Access - shell with the rights of the ordinary user through SSH, compromised web service or container.
2. Privilege Escalation (T1068) - exploit through splice()+ ESP/XFRM poisons page cache setuid-binary.
3. Post-exploitation - root shell. There are no logs in dmesg, there is no disk record, SELinux in the standard configuration does not work.
A separate story for Kubernetes-operators: on GitHub lies PoC (Percivalll/Dirty-Frag-Kubernetes-PoC, 13 stars), demonstrating the way out of the default unvital feed on the Amazon EKS nodays through CVE-2026-43284. Default Security Context Constraints does not help here - page-cacheya poisoning does not require privileged capabilities.
Evolution of page-cache vulnerabilities: from Dirty Pipe to Fragnesia
Here you should pay attention to two points. CVE-2026-43284 - the only one with CVSS 8.8 and vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Component S:C (Scope Changed) - The vulnerability in the network stack goes beyond it and hits the page cache of the entire system. A Fragnesia (CVE-2026-46300) sits in the kernel with version 3.9, released in April 2013. More than 13 years of vulnerable code in the production - and no one noticed.
According to Huntress, all vulnerabilities are found using LLM models and published in a short time: CopyFail - April 29 (Xint Code team), Dirty Frag - May 7 (Hyunwoo Kim), Fragnesia - May 13 (William Bowling, V12 Security).
Zero-copy and splice: the root of the problem
Zero-copy is a legitimate nucleus optimization that exists with kernel 2.2 (1999). When transferring data between file descriptors, the CPU does not copy bytes between buffers, but transmits pointers to existing memory pages through the DMA. According to the Huntress description: instead of four context switches and four copiers - two switches and zero CPU-driven memory solutions.
System Challenge splice() - a key element of all attacks of the family. It moves data from pipe to socket, substituting a link to page-cache instead of a copy. The kernel when requesting data checks page cache first: if the memory page is returned directly, without contacting the disk.
The problem arises when the subsystem-recipient performs in-place crypto operation (encryption or decryption) on top of the received page. If the page belongs to the page cache read-only file - its contents in RAM are modified. The file on the disk is intense, but each subsequent read() returns the poisoned data.
The author Dryty Frag formulates this: "what both vulnerabilities have in common - on the zero-copy send path, where splice() substitutes a link to page-cache a page in the frag slot sending skb, the receiving side of the kernel performs in-place crypto over this frag-a. As a result, the page cache of files to which the unvited user has only read-access is modified in RAM.
Dirty Frag: CVE-2026-43284 and XFRM vulnerability
CVE-2026-43284 (CVSS 8.8, CWE-123 - Write-what-where Condition) - a logical error in the ESP (Encapsulating Security Payload) subsystem when using XFRM.
Mechanics from patch in NVD: MSG_SPLICE_PAGES allows you to attach pages from pipe directly to sk_buff. TCP-stoke correctly marked such skb flag SKBFL_SHARED_FRAG After the call skb_splice_from_iter(), signaling: data cannot be modified in-place, you need a private copy. But IPv4/IPv6 datagram appendd paths for UDP this flag was not installed at splicing pages.
Bottom line: ESP-in-UDP package from shared pipe pages looks like a package with your own data. When an ESP receiver performs in-place decryption, he writes on top of the page-cache page on which the attacker had only read-access.
According to OSV.dev, the vulnerable code is present in the kernels from 4.11.0. Fixed versions of LTS-flows: 5.10.255, 5.15.205. Red Hat released patch RHSA-2026:16062 (May 11, 2026) for RHEL 10 - package kernel-0:6.12.0-124.56.1.el10_1. Debian closed in the DSA-6258-1 (May 9, bookworm: linux 6.1.170-3) and DSA-6253-1 (May 8, trixie: linux 6.12.86-1).
As the author of Dirty Frag notes: "as opposed to Dirty Pipe, which rewrote struct pipe_buffer. Dirty Frag rewrites frag to struct sk_buff"from here and the name.
CVE-2026-43500 - RxRPC-vector
CVE-2026-43500 (CVSS 7.8, CWE-787/CWE-123) - subsystem RxPC, Andrew File System protocol. From NVD: DATA-package handler in rxrpc_input_call_event() and RESPONSE in rxrpc_verify_response() copi skb into linear buffer before security ops only when skb_cloned() returns true. But skb, which is not a clone, but contains the externally-sold-landd fragments (s SKBFL_SHARED_FRAG from splice() through UDP), processed in-place - and hello, recording in page cache.
The vulnerability is injected into the nucleus 5.3 (2019). According to Red Hat, CVE-2026-43500 does not affect Red Hat products - the rmskrc module is not included in the RHEL configuration. On Ubuntu, Fedora, Arch module is available by default.
Fragnesia (CVE-2026-46300): operation through coalesequent skb
CVE-2026-46300 (CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-787/CWE-123) is the third option in the series, but with a unique mechanic. And the "long-lived" bug.
From patch (NVD): skb_try_coalesce() can attach paged frags from @from to @to. If @from has established SKBFL_SHARED_FRAG. the resultant @to skb contains the same externally-owned frags, but the casual-frag marker Lost. Invariant Broken: ESP input checks skb_has_shared_frag() before the decision to copy the data. The marker is not - ESP considers frags its own and performs in-place decryption, writing in the page cache.
William Bowling (V12 Security) describes: "The vulnerability allows an arbitrary post in the page cache read-only through the XFRM ESP-in-NTCP subsystem without race condition."
Fragnesia covers the widest range of vulnerable versions: from kernel 3.9.0 (April 2013) to fix. Pattated LTS versions: 5.10.257, 5.15.208. Debian: DSA-6306-1 (May 28, bookworm: linux 6.1.174-1), DSA-6295-1 (May 23, trixie: linux 6.12.90-1). Red Hat: RHSA-2026:1950
On Rocky Linux 8 patch Dirty Frag does not close Fragnesia - confirmed on the Rocky Linux forum, a separate update is required. I'd check it out first, if you're on Rocky.
Not some experimental code - combat exploits to obtain root shell from an ordinary user. According to FIRST.org, EPS-evaluation CVE-2026-31431 (CopyFal) is 0.9627, and CVE-2026-43284 (Dirty Frag) - 0.9324. Both in top 1% are likely to operate in a 30-day window. CopyFail is already in the CISA KEV catalog with the mark "active exploit" and patching deadline on May 15, 2026. All four vulnerabilities - direct descendants of Dirty Pipe (CVE-2022-0847): The same primitive recording in page cache through zero-copy paths, only through different kernel subsystems.
Why an attacker page-cache LPE
The essence is a replacement of the content of setuid-binary (/usr/bin/su, /usr/bin/sudo) or system files (/etc/passwd) right in RAM. The file on the disk is intact, but each appeal to it returns a poisoned copy from page cache. Root-access without recording on disk and without aerates in dmesg
On the inner pentest, the chain looks like this:
1. Initial Access - shell with the rights of the ordinary user through SSH, compromised web service or container.
2. Privilege Escalation (T1068) - exploit through splice()+ ESP/XFRM poisons page cache setuid-binary.
3. Post-exploitation - root shell. There are no logs in dmesg, there is no disk record, SELinux in the standard configuration does not work.
A separate story for Kubernetes-operators: on GitHub lies PoC (Percivalll/Dirty-Frag-Kubernetes-PoC, 13 stars), demonstrating the way out of the default unvital feed on the Amazon EKS nodays through CVE-2026-43284. Default Security Context Constraints does not help here - page-cacheya poisoning does not require privileged capabilities.
Evolution of page-cache vulnerabilities: from Dirty Pipe to Fragnesia
Here you should pay attention to two points. CVE-2026-43284 - the only one with CVSS 8.8 and vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H. Component S:C (Scope Changed) - The vulnerability in the network stack goes beyond it and hits the page cache of the entire system. A Fragnesia (CVE-2026-46300) sits in the kernel with version 3.9, released in April 2013. More than 13 years of vulnerable code in the production - and no one noticed.
According to Huntress, all vulnerabilities are found using LLM models and published in a short time: CopyFail - April 29 (Xint Code team), Dirty Frag - May 7 (Hyunwoo Kim), Fragnesia - May 13 (William Bowling, V12 Security).
Zero-copy and splice: the root of the problem
Zero-copy is a legitimate nucleus optimization that exists with kernel 2.2 (1999). When transferring data between file descriptors, the CPU does not copy bytes between buffers, but transmits pointers to existing memory pages through the DMA. According to the Huntress description: instead of four context switches and four copiers - two switches and zero CPU-driven memory solutions.
System Challenge splice() - a key element of all attacks of the family. It moves data from pipe to socket, substituting a link to page-cache instead of a copy. The kernel when requesting data checks page cache first: if the memory page is returned directly, without contacting the disk.
The problem arises when the subsystem-recipient performs in-place crypto operation (encryption or decryption) on top of the received page. If the page belongs to the page cache read-only file - its contents in RAM are modified. The file on the disk is intense, but each subsequent read() returns the poisoned data.
The author Dryty Frag formulates this: "what both vulnerabilities have in common - on the zero-copy send path, where splice() substitutes a link to page-cache a page in the frag slot sending skb, the receiving side of the kernel performs in-place crypto over this frag-a. As a result, the page cache of files to which the unvited user has only read-access is modified in RAM.
Dirty Frag: CVE-2026-43284 and XFRM vulnerability
CVE-2026-43284 (CVSS 8.8, CWE-123 - Write-what-where Condition) - a logical error in the ESP (Encapsulating Security Payload) subsystem when using XFRM.
Mechanics from patch in NVD: MSG_SPLICE_PAGES allows you to attach pages from pipe directly to sk_buff. TCP-stoke correctly marked such skb flag SKBFL_SHARED_FRAG After the call skb_splice_from_iter(), signaling: data cannot be modified in-place, you need a private copy. But IPv4/IPv6 datagram appendd paths for UDP this flag was not installed at splicing pages.
Bottom line: ESP-in-UDP package from shared pipe pages looks like a package with your own data. When an ESP receiver performs in-place decryption, he writes on top of the page-cache page on which the attacker had only read-access.
According to OSV.dev, the vulnerable code is present in the kernels from 4.11.0. Fixed versions of LTS-flows: 5.10.255, 5.15.205. Red Hat released patch RHSA-2026:16062 (May 11, 2026) for RHEL 10 - package kernel-0:6.12.0-124.56.1.el10_1. Debian closed in the DSA-6258-1 (May 9, bookworm: linux 6.1.170-3) and DSA-6253-1 (May 8, trixie: linux 6.12.86-1).
As the author of Dirty Frag notes: "as opposed to Dirty Pipe, which rewrote struct pipe_buffer. Dirty Frag rewrites frag to struct sk_buff"from here and the name.
CVE-2026-43500 - RxRPC-vector
CVE-2026-43500 (CVSS 7.8, CWE-787/CWE-123) - subsystem RxPC, Andrew File System protocol. From NVD: DATA-package handler in rxrpc_input_call_event() and RESPONSE in rxrpc_verify_response() copi skb into linear buffer before security ops only when skb_cloned() returns true. But skb, which is not a clone, but contains the externally-sold-landd fragments (s SKBFL_SHARED_FRAG from splice() through UDP), processed in-place - and hello, recording in page cache.
The vulnerability is injected into the nucleus 5.3 (2019). According to Red Hat, CVE-2026-43500 does not affect Red Hat products - the rmskrc module is not included in the RHEL configuration. On Ubuntu, Fedora, Arch module is available by default.
Fragnesia (CVE-2026-46300): operation through coalesequent skb
CVE-2026-46300 (CVSS 7.8, vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, CWE-787/CWE-123) is the third option in the series, but with a unique mechanic. And the "long-lived" bug.
From patch (NVD): skb_try_coalesce() can attach paged frags from @from to @to. If @from has established SKBFL_SHARED_FRAG. the resultant @to skb contains the same externally-owned frags, but the casual-frag marker Lost. Invariant Broken: ESP input checks skb_has_shared_frag() before the decision to copy the data. The marker is not - ESP considers frags its own and performs in-place decryption, writing in the page cache.
William Bowling (V12 Security) describes: "The vulnerability allows an arbitrary post in the page cache read-only through the XFRM ESP-in-NTCP subsystem without race condition."
Fragnesia covers the widest range of vulnerable versions: from kernel 3.9.0 (April 2013) to fix. Pattated LTS versions: 5.10.257, 5.15.208. Debian: DSA-6306-1 (May 28, bookworm: linux 6.1.174-1), DSA-6295-1 (May 23, trixie: linux 6.12.90-1). Red Hat: RHSA-2026:1950
On Rocky Linux 8 patch Dirty Frag does not close Fragnesia - confirmed on the Rocky Linux forum, a separate update is required. I'd check it out first, if you're on Rocky.
