Overview
Linux kernel security in 2026 highlighted by the dirtyfrag vulnerability family — a cat-and-mouse pattern of page-cache write primitives bypassing incremental mitigations.
Timeline
- 2026-04: Copy Fail (CVE-2026-31431) — AF_ALG 4-byte page-cache write
- 2026-05-08: DirtyFrag (CVE-2026-43284/43500) — SKBFL_SHARED_FRAG mitigation
- 2026-05-14: Fragnesia (CVE-2026-46300) — flag dropped in skb coalesce
- 2026-05-21: dirtyclone (CVE-2026-43503) patched in v7.1-rc5
- 2026-07-07: ghostlock (CVE-2026-43499) disclosed — 15-year rtmutex stack-UAF; local root + container escape; Nebula Security VEGA; $92K kernelCTF bounty (2026-07-11-ghostlock-nebula-primary-research)
- 2026-06-27: JFrog public disclosure with PoC analysis
Impact Areas
- Cloud VMs, Kubernetes, container workloads with unprivileged user namespaces
- Multi-tenant environments where CAP_NET_ADMIN obtainable via namespaces