Linux kernel hardening tool ModuleJail released as new privilege‑escalation flaws emerge

A series of critical Linux kernel local privilege escalation (LPE) vulnerabilities—Copy Fail, Dirty Frag, Fragnesia and the newly disclosed DirtyDecrypt (CVE‑2026‑31635)—were reported within weeks, prompting the community to seek broader mitigation measures. DirtyDecrypt, discovered by Zellic and V12, exploits a missing copy‑on‑write guard in the rxgk_decrypt_skb() function, allowing an attacker to write to shared page‑cache memory and gain root privileges on systems compiled with CONFIG_RXGK, such as Fedora, Arch Linux and openSUSE Tumbleweed. The proof‑of‑concept is publicly available on GitHub, and while the flaw is patched in mainline kernels, it highlights the risk of local exploits turning into container escapes.

In response, the ModuleJail project introduced a lightweight hardening script that automatically blacklists unused kernel modules, reducing the attack surface for such LPE bugs. Implemented as a single POSIX shell script, it scans currently loaded modules, generates a modprobe.d blacklist file, and offers three baseline profiles for servers, desktops and minimal systems. The tool does not patch specific CVEs but limits the ability to load vulnerable modules after a system reaches a steady state. It has been tested on Ubuntu 24.04 LTS, Debian 13.4, Rocky Linux 9.7 and other distributions, with DEB and RPM packages available.

Both the new vulnerability and the mitigation underscore the ongoing challenge of securing the Linux kernel against rapid, successive attacks.