Dirty Frag: The Linux Zero-Day Getting Root on Every Major Distro (Demo + Mitigation)

Dirty Frag is a Linux local privilege escalation exploit that chains two kernel vulnerabilities to achieve root access on most current Linux distributions, including fully patched Debian 13 Trixie. As of early May 2026, no official patches exist yet for most distros. A live demo shows the exploit gaining root in seconds. The primary focus is on mitigation: disabling the specific kernel modules being exploited via a shell command, which immediately blocks the attack. Risks of the mitigation are discussed, particularly for users running IPSec VPNs. Links to advisories from Ubuntu, Red Hat, Alma Linux, and others are provided. The vulnerability is a local privilege escalation, meaning an attacker must already have local user access, reducing risk for single-user or admin-only systems.