Linux Done DIRTY: 4 Page Cache Exploits Running Amok

In just a few weeks, researchers have exposed a string of related Linux local privilege escalation bugs. This video breaks down four of them: copy-fail, dirty-frag, fragnesia, and dirty decrypt. You will see live demonstrations on an unpatched Ubuntu 24.04 system showing how a normal local user can become root without entering a password. We dive into the proof-of-concept scripts to explain the core issue: page-cache corruption. These bugs are not identical vulnerabilities, and they do not all live in the same kernel code. But they point to the same dangerous pattern: kernel paths that can corrupt shared page-cache-backed memory when they should first make a private copy. That matters because privileged binaries like su may be read from the page cache. If an exploit poisons the cached in-memory copy of /usr/bin/su, Linux may execute attacker-controlled bytes while the real file on disk remains untouched. This also explains the repeated su behavior in the demo: after the exploit runs once, exiting the root shell does not necessarily clear the poisoned cached page. Running su again may still hit the altered in-memory version. That is not traditional on-disk persistence. It is page-cache poisoning. We also explain why these are local privilege escalation bugs, not remote internet-to-root bugs by themselves. An attacker usually needs an initial foothold first, such as a low-privilege account, malware execution, a vulnerable web application, a web shell, or a compromised container. But once they have local code execution, turning that access into root can be devastating. If you run Linux servers, cloud workloads, shared systems, or environments where untrusted local code might execute, this is exactly the kind of kernel security trend worth watching. Patch status matters, kernel versions matter, distribution mitigations matter, and local root exploits should not be dismissed as harmless. // Sources // BleepingComputer — DirtyDecrypt / DirtyCBC news report - https: