Dirty Frag: Linux root-access exploit leaked; kernel patches available

Linux is facing a new severe kernel exploit named Dirty Frag that lets containers and untrusted users gain root access, the second major Linux threat in as many weeks after Copy Fail ¹.

Dirty Frag enables low‑privilege users, including those running virtual machines, to escalate to root on affected systems; the flaw is especially dangerous in shared hosting and multi‑tenant environments ¹.

Exploit code was leaked online three days ago and is deterministic—working consistently across virtually all Linux distributions without causing crashes—making detection and forensics harder ¹.

Microsoft has said it has seen signs of actors experimenting with Dirty Frag in the wild, increasing the urgency for operators to patch ¹.

Researcher Hyunwoo Kim disclosed the issue; the exploit chains two flaws tracked as CVE‑2026‑43284 and CVE‑2026‑43500. Both were patched in the Linux kernel, but distributions had not incorporated fixes when the proof‑of‑concept was published, effectively creating a zero‑day window ¹.

Security firm Aviatrix described Dirty Frag as an "immediate and significant threat" and urged organisations to apply kernel patches and mitigations swiftly ¹.

Production‑version patches are coming online; operators should prioritise kernel and distribution updates and follow vendor advisories to close this escalation path ¹.