4 Dirty Linux Bugs Expose a Bigger Root Problem

In just a few weeks, researchers have exposed a string of related Linux local privilege escalation bugs. This video breaks down four of them: copy-fail, dirty-frag, fragnesia, and dirty decrypt. You will see live demonstrations on an unpatched Ubuntu 24.04 system showing how a normal local user can become root without entering a password. We dive into the proof-of-concept scripts to explain the core issue: page-cache corruption. These bugs are not identical vulnerabilities, and they do not all live in the same kernel code. But they point to the same dangerous pattern: kernel paths that can corrupt shared page-cache-backed memory when they should first make a private copy. That matters because privileged binaries like su may be read from the page cache. If an exploit poisons the cached in-memory copy of /usr/bin/su, Linux may execute attacker-controlled bytes while the real file on disk remains untouched. This also explains the repeated su behavior in the demo: after the exploit runs once, exiting the root shell does not necessarily clear the poisoned cached page. Running su again may still hit the altered in-memory version. That is not traditional on-disk persistence. It is page-cache poisoning. We also explain why these are local privilege escalation bugs, not remote internet-to-root bugs by themselves. An attacker usually needs an initial foothold first, such as a low-privilege account, malware execution, a vulnerable web application, a web shell, or a compromised container. But once they have local code execution, turning that access into root can be devastating. If you run Linux servers, cloud workloads, shared systems, or environments where untrusted local code might execute, this is exactly the kind of kernel security trend worth watching. Patch status matters, kernel versions matter, distribution mitigations matter, and local root exploits should not be dismissed as harmless. // Sources // BleepingComputer — DirtyDecrypt / DirtyCBC news report - https://www.bleepingcomputer.com/news/security/exploit-available-for-new-dirtydecrypt-linux-root-escalation-flaw/ Xint — Copy Fail technical write-up - https://xint.io/blog/copy-fail-linux-distributions Ubuntu — Copy Fail advisory and mitigation guidance -https://ubuntu.com/blog/copy-fail-vulnerability-fixes-available Microsoft Security Blog — Copy Fail analysis - https://www.microsoft.com/en-us/security/blog/2026/05/01/cve-2026-31431-copy-fail-vulnerability-enables-linux-root-privilege-escalation/ Ubuntu — Dirty Frag advisory and mitigation guidance - https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available    Ubuntu — Fragnesia advisory and mitigation guidance - https://ubuntu.com/blog/fragnesia-linux-vulnerability-fixes-available Ikotas Labs — RxGK variant / DirtyDecrypt background - https://ikotaslabs.com/news/2026-05-11  Linux Kernel Documentation — AF_ALG userspace crypto interface - https://docs.kernel.org/crypto/userspace-if.html  Linux Kernel Page Cache Documentation - https://docs.kernel.org/mm/page_cache.html  // David's SOCIAL // Discord: https://discord.com/invite/usKSyzb X: https://www.twitter.com/davidbombal Instagram: https://www.instagram.com/davidbombal LinkedIn: https://www.linkedin.com/in/davidbombal Facebook: https://www.facebook.com/davidbombal.co TikTok: http://tiktok.com/@davidbombal YouTube: https://www.youtube.com/@davidbombal Spotify: https://open.spotify.com/show/3f6k6gERfuriI96efWWLQQ SoundCloud: https://soundcloud.com/davidbombal Apple Podcast: https://podcasts.apple.com/us/podcast/david-bombal/id1466865532 // MY STUFF // https://www.amazon.com/shop/davidbombal // SPONSORS // Interested in sponsoring my videos? Reach out to my team here: [email protected] // MENU // 0:00 - Linux vulnerabilities 0:19 - Copy Fail quick demo 02:20 - Vulnerabiltiy summary 03:10 - DirtyDecrypt explained 03:53 - Linux cache explained 04:40 - Copy Fail demo 05:28 - Copy Fail script explained 09:45 - Dirty Frag demo 11:48 - Fragnesia demo 12:42 - Summary 12:59 - DirtyDecrypt demo 14:31 - Vulnerabilities summary 15:25 - Conclusion Please note that links listed may be affiliate links and provide me with a small percentage/kickback should you use them to purchase any of the items listed or recommended. Thank you for supporting me and this channel! Disclaimer: This video is for educational purposes only. #linux #pagecache #dirtydecrypt