VULNERABILITY 🔴 1×KEV
CVE-2026-31431 in Linux Kernel: 'Dirty Frag' LPE Vulnerability Actively Exploited, Affects Juniper and Major Distributions
- A Local Privilege Escalation (LPE) vulnerability, named 'Dirty Frag', exists in the Linux Kernel, allowing a local unprivileged user to gain root access.
- CONFIRMED EXPLOITATION: This vulnerability was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on 2026-05-01.
- Immediate action required: Patch all affected Linux systems and appliances. Prioritize systems where unprivileged users have shell access.
Technical Analysis
CVE-2026-31431, referred to as 'Dirty Frag', is a Local Privilege Escalation (LPE) vulnerability within the Linux kernel. The vulnerability allows an authenticated local attacker with basic user privileges to execute code with root-level permissions. While the specific mechanism is not detailed in the provided intelligence, the name 'Dirty Frag' suggests a potential flaw in the kernel's handling of IP packet fragmentation. The exploit enables full system compromise by the local user.
Reports indicate the vulnerability is universal, affecting major Linux distributions and downstream products that utilize the Linux kernel, such as network appliances from Juniper. A notable discrepancy exists in scoring: while the official CVE record has not yet been assigned a CVSS score, a national CERT bulletin reports a maximum CVSS of 7.8 for affected products, which is consistent with an LPE of this nature. The core threat is the elevation from a low-privilege foothold, often gained via a separate ingress vector, to complete control of the affected system.
Affected Systems
- Major Linux Distributions (specific versions not provided)
- Juniper Products running vulnerable Linux kernel versions (specific products not provided)
Intelligence Context
The primary driver for prioritization is the vulnerability's CONFIRMED status on CISA's KEV catalog. This is an authoritative signal of active, in-the-wild exploitation. While the EPSS score of 0.03912 (3.91st percentile) predicts a low probability of widespread exploitation, the KEV listing is based on observed reality and must take precedence. The 'FRESH EXPLOIT' label, with the KEV entry being only 8 days old, places defenders in a critical window to apply patches before exploit code becomes more commoditized. The intelligence spread from a national CERT (AusCERT) to respected technical sources like SANS ISC confirms the credibility of the threat.
Remediation & Defense
- Restrict unprivileged shell access on critical systems.
- Implement application whitelisting to prevent execution of unauthorized binaries.
- Monitor for anomalous processes running with root privileges, particularly those spawned by non-root user accounts.
- Audit system logs for unexpected kernel-level errors or crashes, potentially related to network packet processing.
Source Timeline
- portal.auscert.org.au — First reporter
- thehackernews.com — Corroborating report
- isc.sans.edu — Technical analysis