Details were released for Dirty Frag, a Linux kernel local privilege escalation vulnerability chain that can allow an unprivileged local user to gain root access across major Linux distributions. The issue chains two page-cache write vulnerabilities in the xfrm-ESP/IPsec and RxRPC kernel paths, extending the same broader bug class as Dirty Pipe and Copy Fail. Public reporting notes that the embargo was broken before coordinated fixes were available across distributions, increasing urgency because exploit details and working proof-of-concept code were released publicly.

The vulnerability is considered especially concerning because it is described as deterministic rather than race-condition based, meaning exploitation does not rely on fragile timing and may be highly reliable when the required kernel interfaces are reachable. Reports note potential impact across Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44. The xfrm-ESP issue has been assigned CVE-2026-43284 and patched in mainline, while the RxRPC issue has been assigned CVE-2026-43500, with patch availability still limited at the time of reporting.

Impact: Successful exploitation may allow a local, unprivileged user to gain root privileges on affected Linux systems. This creates increased risk for multi-user servers, developer systems, shared hosting environments, and container platforms that run untrusted or third-party workloads. In containerized environments, Dirty Frag may also increase the risk of container escape scenarios where vulnerable kernel interfaces are exposed or where workload isolation is not sufficiently hardened.

Recommendation: Organizations should monitor vendor advisories and apply kernel updates as soon as patches are available for affected distributions. Until patches are deployed, access to the affected kernel paths should be reduced by preventing the vulnerable esp4, esp6, and rxrpc modules from loading where they are not required. Linux systems should be reviewed for local users or workloads with access to vulnerable interfaces, especially systems allowing untrusted shell access, shared development activity, or container workloads. Container environments should enforce hardened defaults such as restrictive seccomp, AppArmor or SELinux profiles, reduced capabilities, and limited access to kernel networking features. Systems with suspected exploitation should be investigated for unauthorized root-level changes, modified authentication files, unexpected setuid binaries, persistence artifacts, and suspicious activity from low-privileged accounts.

Microsoft reported two vulnerabilities in Semantic Kernel, CVE-2026-26030 and CVE-2026-25592, that could allow prompt injection against AI agents to escalate into host-level execution risks. The research highlights how AI agents connected to plugins or tools can introduce systemic risk when model-controlled parameters are passed into high-impact functions such as search filters, code execution plugins, file transfer helpers, or host filesystem operations.

CVE-2026-26030 affects Semantic Kernel Python versions before 1.39.4 when agents use the Search Plugin backed by the In-Memory Vector Store with default filter functionality. In that scenario, attacker-controlled prompt input could be interpolated into a Python lambda expression evaluated by the framework, allowing a crafted prompt to bypass blocklist-based validation and execute arbitrary code. CVE-2026-25592 affects Semantic Kernel .NET SDK versions before 1.71.0, where an exposed DownloadFileAsync function could allow AI-controlled file writes to arbitrary host paths, potentially enabling sandbox escape and persistence through locations such as the Windows Startup folder.

Impact: Successful exploitation could allow an attacker to move from prompt injection to code execution, arbitrary file write, sandbox escape, or host compromise depending on the vulnerable agent configuration. Affected agents may expose sensitive host files, write malicious payloads to persistence locations, spawn suspicious child processes, or execute commands from the agent host process. The risk is highest where AI agents process untrusted input and have access to plugins that interact with local files, code execution environments, search backends, or other system-level tools.

Recommendation: Organizations using Semantic Kernel should upgrade Python semantic-kernel deployments to version 1.39.4 or later and Semantic Kernel .NET SDK deployments to version 1.71.0 or later. AI agent tools should be reviewed to ensure model-controlled parameters are treated as untrusted input, especially for filesystem paths, code execution, search filters, shell commands, and upload/download functions. Existing deployments should be assessed for the vulnerable window before patching, with endpoint telemetry reviewed for suspicious child processes from agent hosts, unexpected outbound connections, unusual file writes, Startup folder modifications, or persistence artifacts. Agent architectures should limit exposed tools to the minimum required scope and enforce path allowlists, input validation, sandboxing, and host-level monitoring.