May-Storm-in-the-Linux-Kernel

May 2026 will be remembered as one of the most turbulent periods in recent years. Critical vulnerabilities in the Linux kernel are being discovered one after another, linked by an architectural problem in the memory page cache (Page Cache).

It can be described as a new class of bugs that allows an unprivileged user to gain root privileges. Let’s break down what happened, why it is dangerous, and how to secure your infrastructure today.

How did everything go?: From Copy Fail to Dirty Frag#

It all started in late April with the discovery of the Copy Fail (CVE-2026-31431) vulnerability. Researchers found that a flawed zero-copy optimization in the kernel’s cryptographic module allowed an attacker to use the splice() system call to overwrite data in RAM for any file-even those marked as read-only.

The domino effect didn’t take long. By early May, leveraging automated AI-assisted fuzzing tools to scan for similar patterns, the community uncovered a series of new vulnerabilities dubbed Dirty Frag (CVE-2026-43284, CVE-2026-43500) and Fragnesia (CVE-2026-46300). This time, the issue hit the kernel’s networking subsystems, specifically IPsec components and the RxRPC module.

The attack vector is simple yet devastating:
The attacker does not modify files on the disk. Instead, they alter a few bytes “on the fly” in the Page Cache (RAM) for critical system utilities /usr/bin/su. As a result, the OS allows you to call a shell from the root user.

Why is this Critical?#

Although these vulnerabilities belong to the LPE (Local Privilege Escalation) class-meaning they require initial access to the system and cannot be exploited “from the outside” on their own-the risk level is deemed high.

  1. The Ultimate Post-Exploitation Weapon: If your web application, CMS, or PHP script has even a minor flaw allowing remote code execution (RCE), an attacker can use Copy Fail or Dirty Frag to become a full root administrator within a second.
  2. A Major Threat to Kubernetes and CI/CD: These exploits run reliably inside isolated containers and Docker runners. If you run untrusted or third-party code in your cloud, attackers can easily “break out” of the container bounds and compromise the entire cluster node.
  3. Publicly Available Exploits: Proof-of-concept (PoC) codes are already circulating publicly. They are written in Python, take up less than 1 KB, and work flawlessly across most popular distributions.

How to Protect Your Systems#

Step 1. Top Priority - Kernel Updates#

Vendors of major distributions (Ubuntu, Red Hat Enterprise Linux, Rocky Linux, AlmaLinux, AWS Linux) have already released or are actively rolling out official patches.

Perform a full system update and make sure to schedule a server reboot so the new kernel can take effect:

# For Ubuntu / Debian:
sudo apt update && sudo apt upgrade -y && sudo reboot

# For RHEL / Rocky Linux / AlmaLinux:
sudo dnf update -y && sudo reboot

If there are no updates for your OS yet, or you cannot schedule a reboot right now, go to step 2.

Step 2. Temporary Mitigation - Blocking Modules#

If for some reason you cannot reboot a production server right away, you can block the vulnerable kernel modules from loading.

Create configuration files to disable them:

# Disabling the module for Copy Fail
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
# For RHEL, the algif_aead module is built-in, so you will have to block the call via grub and reboot
/sbin/grubby --update-kernel=ALL --args="initcall_blacklist=algif_aead_init"

# Disabling modules for Dirty Frag / Fragnesia
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

# Unload the modules from memory (if not currently locked by active processes)
rmmod algif_aead esp4 esp6 rxrpc 2>/dev/null || true

Note: Disabling these modules will not break standard services like SSH or LUKS encryption, but it may impact specific IPsec VPN configurations. Test this workaround in a staging environment before deploying to production.

Conclusion#

The Page Cache situation in Linux proves once again that security is a continuous process. Even code that has been considered stable and optimized for years can turn out to be vulnerable under the lens of modern analysis tools. Do not delay your patch management. Stay safe and happy sysadmining!