As cited
Copy frozen at (site build).
vulnerabilities
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
Linux kernel vulnerabilities Copy Fail (CVE-2026-31431), Copy Fail 2, and DirtyFrag enable local privilege escalation through page cache corruption bugs exploitable via legitimate kernel interfaces like AF_ALG socket and splice() syscalls. Copy Fail has been observed in active exploitation and added to CISA's Known Exploited Vulnerabilities catalog, while DirtyFrag extends the attack surface to the networking stack with multiple exploitation paths that bypass some existing mitigations.
Why it matters: Linux system administrators and security teams must detect and patch these vulnerabilities immediately: attackers can escalate from unprivileged local access to root using short, reliable proof-of-concept code across major distributions (Ubuntu, RHEL, Amazon Linux, SUSE), and detection requires monitoring syscall primitives (AF_ALG socket, splice, unshare) rather than specific exploit signatures since multiple public reimplementations already exist.
- Source published
- First seen by Cybersecurity Tracker
Source attribution
Correction
Correction recorded as of .
vulnerabilities
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
Linux kernel vulnerabilities Copy Fail (CVE-2026-31431), Copy Fail 2, and DirtyFrag enable local privilege escalation through page cache corruption bugs exploitable via legitimate kernel interfaces like AF_ALG socket and splice() syscalls. Copy Fail has been observed in active exploitation and added to CISA's Known Exploited Vulnerabilities catalog, while DirtyFrag extends the attack surface to the networking stack with multiple exploitation paths that bypass some existing mitigations.
Why it matters: Linux system administrators and security teams must detect and patch these vulnerabilities immediately: attackers can escalate from unprivileged local access to root using short, reliable proof-of-concept code across major distributions (Ubuntu, RHEL, Amazon Linux, SUSE), and detection requires monitoring syscall primitives (AF_ALG socket, splice, unshare) rather than specific exploit signatures since multiple public reimplementations already exist.
- Source published
- First seen by Cybersecurity Tracker