Linux Kernel LPE Probe Suite — Copy Fail & Dirty Frag

Safe detection tooling for two related Linux kernel local privilege escalation vulnerability families — Copy Fail (CVE-2026-31431) and Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — both affecting all major distributions since 2017, both exploitable by any unprivileged local user, and both requiring independent mitigations.

These probes open no sockets and perform no crypto or network operations. Detection is based purely on kernel version, distro package metadata, module state, and active mitigation flags — all world-readable without sudo.

⚠️ Important: two separate vulnerabilities

Applying the Copy Fail mitigation does NOT protect against Dirty Frag. Both probes must be run and both mitigations applied independently.

Files

.
├── cve-2026-31431-check.sh          Copy Fail probe (all output modes)
├── copy_fail_userparameter.conf     Zabbix agent UserParameter — Copy Fail
├── zabbix_template_copy_fail.yaml   Zabbix 6.4 template — Copy Fail
├── copy_fail_auditd.rules           auditd behavioral detection — Copy Fail
├── cve-2026-43284-check.sh          Dirty Frag probe (all output modes)
├── dirty_frag_userparameter.conf    Zabbix agent UserParameter — Dirty Frag
├── wazuh_sca/
│   └── copy_fail_sca.yml            Wazuh SCA compliance policy
└── ansible/
    └── copy_fall_scan.yml           Fleet-wide Ansible scan playbook

CVE-2026-31431 — Copy Fail

Background

The exploit requires this exact syscall chain:

socket(AF_ALG, SOCK_SEQPACKET, 0)
bind(fd, {alg_type="aead", alg_name="authencesn(hmac(sha256),cbc(aes))"})
accept(fd, ...)
splice(suid_binary_fd, op_fd)   ← page cache fed into crypto subsystem
sendmsg / recvmsg               ← 4-byte scratch write lands in page cache

None of these are touched by the probe. Detection is based on:

1. Kernel version range — regression in 4.14–6.17; fixed in 6.18.22 / 6.19.12 / 6.20+
2. Distro package version — vendor backport detection with known-patched thresholds
3. Module state — loaded, absent, built-in, or .ko on disk (auto-loadable)
4. Active mitigations — modprobe.d blacklist and initcall_blacklist cmdline flag

Quick start

chmod +x cve-2026-31431-check.sh
./cve-2026-31431-check.sh           # human-readable
./cve-2026-31431-check.sh --json    # machine-readable
./cve-2026-31431-check.sh --nagios  # Nagios/Icinga/NRPE
./cve-2026-31431-check.sh --zabbix  # integer 0/1/2 for Zabbix item

Exit codes: 0 = PATCHED or MITIGATED · 1 = VULNERABLE · 2 = UNKNOWN

Patched package versions

The script compares against these thresholds automatically and sets verdict to PATCHED when the running package meets or exceeds the threshold.

RHEL-family: built-in module caveat

On RHEL, AlmaLinux, Rocky Linux and derivatives, algif_aead is compiled into the kernel. The modprobe.d workaround has no effect. Only initcall_blacklist=algif_aead_init on the kernel cmdline works. The probe detects this and warns explicitly.

grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"
reboot

CVE-2026-43284 / CVE-2026-43500 — Dirty Frag

Background

Dirty Frag chains two in-place decrypt fast-path bugs discovered by Hyunwoo Kim (@v4bel), disclosed ~2026-05-07, one week after Copy Fail:

• CVE-2026-43284 — xfrm-ESP fast path (esp4, esp6); upstream fix f4c50a4034e6
• CVE-2026-43500 — RxRPC fast path (rxrpc); upstream fix aa54b1d27fe0

The exploit attaches pipe pages from the /usr/bin/su page cache as paged socket-buffer fragments, then drives in-place decryption with an attacker-chosen key — writing arbitrary bytes directly into the cached copy of a setuid binary, without touching the file on disk.

The Copy Fail mitigation (algif_aead blacklist) does NOT prevent Dirty Frag.

Quick start

chmod +x cve-2026-43284-check.sh
./cve-2026-43284-check.sh           # human-readable
./cve-2026-43284-check.sh --json    # machine-readable
./cve-2026-43284-check.sh --nagios  # Nagios/Icinga/NRPE
./cve-2026-43284-check.sh --zabbix  # integer 0/1/2 for Zabbix item

The probe checks esp4, esp6, and rxrpc independently and reports separate cve_43284_safe / cve_43500_safe booleans in JSON output.

IPsec warning

esp4 and esp6 are the kernel-side ESP transforms used by IPsec (strongSwan, Libreswan). Blacklisting them breaks IPsec tunnels. The probe detects active IPsec usage via ip xfrm state and daemon detection, and adjusts the remediation advice accordingly:

• No IPsec: apply the full modprobe.d blacklist for all three modules.
• IPsec in use: restrict unprivileged user namespaces (blocks the ESP path; also blacklist rxrpc separately if not needed):
  root@kitploit:~

  # RHEL-family
  sysctl -w user.max_user_namespaces=0
  echo "install rxrpc /bin/false" >> /etc/modprobe.d/dirtyfrag.conf
  
  # Ubuntu / Debian
  sysctl -w kernel.unprivileged_userns_clone=0
  echo "install rxrpc /bin/false" >> /etc/modprobe.d/dirtyfrag.conf
  

Patched package versions

For systems awaiting a patched kernel, apply the modprobe.d blacklist immediately (taking the IPsec caveat into account).

RHEL 8 / rxrpc

AlmaLinux / RHEL 8 does not build the rxrpc module at all. The probe auto-marks kernel_vuln_rxrpc=not_affected on RHEL/Rocky/Alma 8.x.

Monitoring integrations

Zabbix

Deploy both probes on each monitored host:

mkdir -p /etc/zabbix/scripts
install -m 750 -o zabbix -g zabbix cve-2026-31431-check.sh /etc/zabbix/scripts/
install -m 750 -o zabbix -g zabbix cve-2026-43284-check.sh /etc/zabbix/scripts/

cp copy_fail_userparameter.conf /etc/zabbix/zabbix_agentd.d/
cp dirty_frag_userparameter.conf /etc/zabbix/zabbix_agentd.d/
systemctl restart zabbix-agent   # or zabbix-agent2

Import zabbix_template_copy_fail.yaml via Configuration → Templates → Import.

UserParameter items provided:

The Copy Fail template includes HIGH trigger on status=1, WARNING on status=2. No sudo required — every file read by both scripts is world-readable.

Nagios / Icinga / NRPE

install -m 755 cve-2026-31431-check.sh /usr/lib/nagios/plugins/
install -m 755 cve-2026-43284-check.sh /usr/lib/nagios/plugins/

# NRPE — add to /etc/nagios/nrpe.cfg:
command[check_copy_fail]=/usr/lib/nagios/plugins/cve-2026-31431-check.sh --nagios
command[check_dirty_frag]=/usr/lib/nagios/plugins/cve-2026-43284-check.sh --nagios

# CheckMK local checks:
echo '#!/bin/bash
OUT=$(/usr/lib/nagios/plugins/cve-2026-31431-check.sh --nagios); RC=$?
echo "$RC CVE-2026-31431 - $OUT"' > /usr/lib/check_mk_agent/local/copy_fail

echo '#!/bin/bash
OUT=$(/usr/lib/nagios/plugins/cve-2026-43284-check.sh --nagios); RC=$?
echo "$RC CVE-2026-43284 - $OUT"' > /usr/lib/check_mk_agent/local/dirty_frag

chmod +x /usr/lib/check_mk_agent/local/copy_fail \
         /usr/lib/check_mk_agent/local/dirty_frag

auditd — behavioral / runtime detection

Detects an active exploit attempt in progress, complementing both static probes.

cp copy_fail_auditd.rules /etc/audit/rules.d/
augenrules --load

# Watch for unexpected AF_ALG callers:
ausearch -k copy_fail_af_alg --interpret | \
    grep -v -E 'cryptsetup|veritysetup|systemd-crypt|kcapi'

Wazuh rule stubs (level 13 / 15) are embedded in the .rules file comments.

Wazuh SCA

cp wazuh_sca/copy_fail_sca.yml /var/ossec/etc/shared/default/
/var/ossec/bin/agent_control -r -a

Results: Security → SCA → Filter by policy cve_2026_31431_copy_fail

Ansible — fleet scan

ansible-playbook -i inventory/hosts ansible/copy_fall_scan.yml
# Limit to a subset:
ansible-playbook -i inventory/hosts ansible/copy_fall_scan.yml --limit webservers

Writes per-host JSON + summary.txt to /tmp/copy_fail_results/ on the controller. The play exits non-zero if any host is VULNERABLE.

Vendor security trackers

References

Copy Fail

• Original Xint/Theori write-up
• CERT-EU Advisory 2026-005
• NVD CVE-2026-31431
• Ubuntu Security Notice USN-8226-1
• Rocky Linux Advisory 2026-05-11
• SUSE responds to Copy Fail

Dirty Frag

• Dirty Frag write-up (copy.fail)
• NVD CVE-2026-43284
• AlmaLinux Advisory 2026-05-07
• Sysdig TRT — Dirty Frag detection analysis
• Microsoft Security Blog — active attack
• Wiz Blog — Dirty Frag