Linux DirtyFrag kernel vulnerability

On May 7th 2026, security researcher Hyunwoo Kim (@v4bel) published DirtyFrag, a Linux kernel vulnerability that lets a local user gain root on most distributions. DirtyFrag works even on systems that have already mitigated Copy Fail (CVE-2026-31431).

eComscan will alert if your server is running a kernel that is vulnerable to DirtyFrag. In most situations, the fix can only be applied by your server administrator / hosting provider.

Risk for ecommerce stores

DirtyFrag requires local code execution to be useful, so a single-user dedicated server is at lower risk. However, the flaw is dangerous on:

• Multi-tenant hosting and shared servers
• Containers and Kubernetes clusters
• CI/CD runners and build hosts
• Any system where untrusted PHP, plugins, or extensions can run

If an attacker first lands a webshell through, for example, a vulnerable Magento extension, DirtyFrag lets them escalate from the web user to full root and disable any host-level security tooling. Attackers may then easily gain administrator access, which makes it extremely hard to detect their presence.

Status

Patches have been submitted to the upstream Linux kernel, but at the time of writing no distribution has shipped a fixed kernel package yet. Until your distribution publishes an updated kernel, emergency mitigation is the only option.

Emergency mitigation

Mitigation requires administrator access, so typically your hosting provider should apply this.

Block the three vulnerable modules from loading and unload them if they are currently active:

cat > /etc/modprobe.d/dirtyfrag.conf <<EOF
install rxrpc /bin/false
install esp4 /bin/false
install esp6 /bin/false
EOF
rmmod rxrpc esp4 esp6 2>/dev/null || true

The rxrpc module is rarely used outside AFS deployments, so disabling it has no impact on regular ecommerce workloads. The esp4 and esp6 modules implement IPsec ESP. Only blacklist these if your server does not use IPsec VPNs, otherwise IPsec tunnels will fail to come up.

For container hosts running untrusted workloads, also restrict capabilities and namespace creation through seccomp and AppArmor profiles.

Once your distribution publishes a patched kernel, schedule an upgrade and reboot at your earliest convenience. We strongly recommend enabling automatic security updates on your servers.

More information

• DirtyFrag write-up
• Related: Copy Fail (CVE-2026-31431)