THREAT OPS › Threat News › Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
Copy Fail and DirtyFrag: Linux Page Cache Bugs in the Wild
<h2>Introduction</h2> <p>Recent Linux kernel privilege escalation vulnerabilities, Copy Fail (CVE-2026-31431) , Copy Fail 2, and DirtyFrag, highlight how subtle page cache corruption bugs can become practical, reliable paths to root. These issues are especially relevant for defenders because exploitation involves legitimate kernel interfaces, local execution, and short proof-of-concept code. Copy
MITRE ATT&CK techniques
- VulnerabilitiesT1588.006
Indicators of compromise
- ef78eb503dba59b19710cedffd3d1697185abbb4sha1
- ebe2a089b8806989e77531adde70314958851648sha1
- CVE-2026-31431cve
- https://copy.fail/url
- https://xint.io/blog/copy-fail-linux-distributionsurl
- https://access.redhat.com/security/vulnerabilities/RHSB-2026-003url
- https://ubuntu.com/blog/copy-fail-vulnerability-fixes-availableurl
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=a664bf3d603durl