A newly disclosed Linux zero-day vulnerability dubbed “Dirty Frag,” also known as “Copy Fail 2,” allows unprivileged local users to reliably escalate privileges to root on most major Linux distributions and may already be under active exploitation in the wild. The exploit chains two (2) kernel vulnerabilities (CVE-2026-43284 in the xfrm-ESP IPsec component and CVE-2026-43500 in the RxRPC subsystem) to modify protected system files in memory without authorization. The flaws, introduced roughly nine (9) years ago in the Linux kernel’s algif_aead cryptographic interface, belong to the same vulnerability class as Dirty Pipe and Copy Fail but are considered especially dangerous because exploitation is deterministic, does not rely on race conditions, avoids kernel crashes, and has a very high success rate. Affected systems include Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, Fedora, and openSUSE Tumbleweed, with potential implications for containerized environments as well. Public disclosure accelerated after a third party leaked exploit details before patches were available, prompting Kim to release full technical documentation and proof-of-concept code. Microsoft reported observing limited suspicious activity potentially linked to Dirty Frag or Copy Fail exploitation, with attackers using compromised SSH accounts, web shells, service account abuse, or remote access compromises to gain initial access before escalating privileges. Observed post-exploitation activity included modification of GLPI LDAP authentication files, system reconnaissance, deletion of PHP session files, and access to remaining session data, indicating attempts to disrupt operations and hijack sessions. Linux vendors including Red Hat, Canonical, Fedora, AlmaLinux, and Amazon have begun releasing patches and mitigations as concerns continue growing around actively exploited Linux kernel privilege escalation vulnerabilities. CTIX analysts urge any affected administrators to patch and apply mitigation techniques immediately to prevent exploitation.