New Linux 'Dirty Frag' zero-day gives root on all major distros

A new Linux zero-day vulnerability called 'Dirty Frag' has been publicly disclosed after an embargo was broken. Discovered by researcher Hyunwoo Kim, it chains two kernel flaws (xfrm-ESP and RxRPC Page-Cache Write vulnerabilities) in the algif_aead cryptographic interface to allow local attackers to gain root privileges on major Linux distributions including Ubuntu, RHEL, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, and Fedora. No patch or CVE exists yet. The exploit is deterministic, requires no race condition, and has a high success rate. A PoC exploit and full documentation have been released on GitHub. This disclosure comes while distros are still patching 'Copy Fail,' another actively exploited root privilege escalation flaw recently added to CISA's Known Exploited Vulnerabilities catalog.