VULNERABILITY 🔴 1×KEV
CVE-2026-31431 in Linux Kernel: Actively Exploited LPE Affecting Multiple Distributions and Juniper Products
- CVE-2026-31431 is a Local Privilege Escalation (LPE) vulnerability, nicknamed 'Dirty Frag', within the Linux Kernel, affecting major distributions and downstream vendor products like those from Juniper.
- CONFIRMED exploitation in the wild. This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-05-01.
- Immediate action required: Prioritize patching of all affected Linux systems and vendor appliances. The KEV listing mandates urgent response.
Technical Analysis
CONFIRMED reports from multiple sources identify CVE-2026-31431 as a Local Privilege Escalation (LPE) vulnerability in the Linux Kernel, referred to as 'Dirty Frag'. An LPE vulnerability allows an attacker who has already achieved initial, low-privilege access to a system to execute code with root-level (administrator) privileges. This effectively grants the attacker full control of the compromised host, enabling them to disable security controls, access sensitive data, and use the system as a pivot point for lateral movement within the network.
The attack requires an existing foothold on the target system, meaning it is not a remote ingress vector. However, once local access is gained, this vulnerability provides a direct path to full system compromise. While specific technical details of the exploit mechanism are not detailed in the provided intelligence, the 'Dirty Frag' moniker INFERRED to be related to memory corruption or improper handling of network packet fragments. The primary impact is the breakdown of the user privilege boundary, a fundamental security control in Linux-based operating systems. Note that while one data feed listed CVSS as 'None', a source article title specified a maximum CVSS of 7.8, which is consistent with a high-impact LPE.
Affected Systems
- Major Linux Distributions (specific versions to be confirmed by distribution maintainers)
- Juniper Products (refer to vendor advisory ESB-2026.4867 for affected versions)
Intelligence Context
The primary driver for immediate action on CVE-2026-31431 is its CONFIRMED status on the CISA KEV catalog. This designation is authoritative evidence of active, in-the-wild exploitation and overrides other predictive metrics. While the EPSS score of 0.03912 (3.91st percentile) suggests a low probability of widespread exploitation, the KEV listing confirms that this prediction was incorrect and exploitation is already occurring. The 'FRESH EXPLOIT' race label indicates that this is a recent threat, with attackers actively leveraging the vulnerability within days of its public disclosure or discovery. The initial report from AUSCERT focusing on Juniper products demonstrates the real-world impact on enterprise-grade hardware, moving this beyond a theoretical kernel issue. Defenders must prioritize this vulnerability for patching based on the KEV status alone.
Remediation & Defense
- No effective workarounds have been reported. Patching is the only definitive mitigation for kernel-level vulnerabilities.
- Monitor for unexpected processes running with root privileges, especially those spawned by unprivileged user accounts.
- Audit system logs for anomalous kernel messages or errors related to memory management.
- Review shell command history (`history`) and audit logs (`/var/log/audit/audit.log`) for suspicious commands indicative of privilege escalation attempts.
Source Timeline
- portal.auscert.org.au — First reporter
- thehackernews.com — Corroborating report
- isc.sans.edu — Technical analysis