# Copy Fail Dirty Frag Mitigation: Critical 2026 Linux LPE Fix

Source: https://srvscripts.com/guides/copy-fail-dirty-frag-mitigation/
Updated: 2026-10-03
Publisher: srvScripts (https://srvscripts.com/)

Three local privilege-escalation bugs in the Linux kernel arrived within a fortnight of each other in 2026, and all three are especially dangerous on shared hosting, where “local” means any customer with a PHP script or an SSH login. Each depends on a kernel module that almost no hosting server actually uses, which means each can be neutralised in minutes with a modprobe blacklist, well before you schedule the reboot for a fixed kernel.

In short: All three flaws depend on kernel modules a hosting server does not use, so write install algif_aead /bin/false, install esp4 /bin/false, install esp6 /bin/false and install rxrpc /bin/false into /etc/modprobe.d/cve-2026-lpe.conf, unload…

**Short answer:** All three flaws depend on kernel modules a hosting server does not use, so write `install algif_aead /bin/false`, `install esp4 /bin/false`, `install esp6 /bin/false` and `install rxrpc /bin/false` into `/etc/modprobe.d/cve-2026-lpe.conf`, unload any that are loaded, and run `dracut -f` so the rule survives a reboot. Add `user.max_user_namespaces = 0` to close the usual exploit entry point. Treat this as a bridge until a patched kernel or a KernelCare live patch is in place.

## The three flaws

Copy Fail, CVE-2026-31431, was published on 29 April. It abuses the `algif_aead` interface, part of the userspace crypto API that lets a process drive kernel AEAD ciphers through a socket. A crafted sequence of operations corrupts memory in a way that yields root. Nothing in a typical web, mail or database stack opens an `AF_ALG` socket.

Dirty Frag covers CVE-2026-43284 and CVE-2026-43500, published 7 May. The flaw sits in the xfrm ESP fragmentation path used by IPsec and in the RxRPC transport used by AFS. It was being exploited in the wild within days. The affected modules are `esp4`, `esp6` and `rxrpc`; blocking them removes the code path entirely, at the cost of IPsec tunnels and AFS mounts.

Fragnesia, CVE-2026-46300, followed on 13 May and is a bypass of the initial Dirty Frag fix using ESP encapsulated in TCP. It is closed by the same module blocks, which is why blocking rather than patching alone was the right first move.

## Check whether the modules are loaded

```
lsmod | grep -E '^(algif_aead|esp4|esp6|rxrpc|af_alg)'
uname -r
```

On most hosting servers the grep returns nothing, which means the modules are not loaded right now. That is not protection: they load on demand the moment a process asks for them, and that process can belong to an unprivileged user. The blacklist is what prevents the on-demand load.

## Block the modules

The `install` directive is stronger than `blacklist`. A plain `blacklist` line only stops automatic loading by alias; `install <module> /bin/false` makes any load attempt, automatic or explicit, run `/bin/false` instead, so it always fails:

```
cat > /etc/modprobe.d/cve-2026-lpe.conf  /etc/sysctl.d/99-lpe-hardening.conf /dev/null | grep -c cve-2026-lpe.conf
sysctl user.max_user_namespaces
```

The modprobe exit code should be non-zero, the initrd should contain the file, and the sysctl should read zero. A common pitfall is applying the blacklist and forgetting `dracut -f`; the server is protected until the next reboot, after which the early-boot module loader ignores the rule for anything loaded before the root filesystem is mounted. Keep the check in your post-reboot runbook until every server in the fleet is on a patched kernel.

## Copy Fail Dirty Frag mitigation at a glance

**Official documentation:** [AlmaLinux wiki](https://wiki.almalinux.org/), [Linux man pages](https://man7.org/linux/man-pages/).

**Related guides:** [Installing Sentinel Firewall as a drop-in CSF replacement on Ubuntu 24.04 and Debian 13](https://srvscripts.com/guides/sentinel-firewall-csf-replacement/) · [Replacing CSF with firewalld + fail2ban on AlmaLinux 9/10, step by step](https://srvscripts.com/guides/replace-csf-with-firewalld-fail2ban/) · [CVE-2026-65638, 65639 and 67402 explained: patching the CSF Messenger and URLGET remote-code flaws](https://srvscripts.com/guides/csf-cve-2026-65638-patch/).

## Frequently asked questions

### Does blocking esp4 and esp6 also protect against Fragnesia?

Yes. Fragnesia (CVE-2026-46300) bypasses the first Dirty Frag patch through ESP encapsulated in TCP but still runs through the same xfrm ESP modules, so the install /bin/false rules remove its code path entirely.

### How long does the modprobe mitigation take to apply?

Writing the modprobe file, unloading the modules and running dracut -f takes under five minutes per server and needs no reboot; the grubby initcall_blacklist parameter for a built-in algif_aead only takes effect on the next boot.

### Can I undo the module blocks after patching the kernel?

Yes. Delete /etc/modprobe.d/cve-2026-lpe.conf, remove the sysctl file and run dracut -f again; kernel.modules_disabled=1 is the one setting that cannot be reversed without a reboot.