linux-announce AT lists.psi.ch

Subject: Linux Mailing List

List archive

Re: [[Linux-announce] ] Dirty Frag: next Kernel vulnerability for gaining root access

From: "Konrad Bucheli (PSI)" <konrad.bucheli AT psi.ch>
To: linux-announce AT lists.psi.ch
Subject: Re: [[Linux-announce] ] Dirty Frag: next Kernel vulnerability for gaining root access
Date: Mon, 18 May 2026 09:46:37 +0200
Arc-authentication-results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=psi.ch; dmarc=pass action=none header.from=psi.ch; dkim=pass header.d=psi.ch; arc=none
Arc-message-signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=Z960g+hbRnEnGjhTGRL5neMTioOAPlyVDEbSO0AnwSk=; b=RXQ281Nq4ZQFjZbKUfSAuxw5i8C3k1RFMt7W0b5UBEbBCSMz5FXAQi0CjV2jk7XpL5g1Q3/jpIPVktpxKlXEA7X6R+xzPO14iow0aWWTi/dQBVJzxB3pM1IAkPvVwt/q/clCz9rl3rtxFy+4LzdfY1J47qi8uR1/+wMD6f/eg9XJm/oEfRBtKSO3Ewk3MK4D3t2Brq3TR3pznrruC8+ZItTf0QXgkqCNjQHh/tHihDBZNyrOQ/ajLeOX6X1vq9XiIa20S6qiBnI+IsWAroX4jvVNoo5nriSGKARmc4L9/0y/YpZRYX12dMCyxg93o2Aon+YJtd37peA1ucmooQHb9Q==
Arc-seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=LekmG7oregU+L6kpBCXhKzvhmlHTXp2GdvEEWTxoRMTW3HjctQXeeKH1b+QQAlVULVt5LvJk24D04fKMRknInc2Ks7o3WTm2sNJnVL9hvBogoVCLPuYSTUKbSMPqzMdhgJdXyG6+o/I/ZmbvyLohPMciYi47sTE4PF1BDIOs1ufD+Fn1TiC0DKQpdTmk4SNea9naQ3ESCmPJl/Y7J4/Yi8rNgzta+kqhE6Ox2aBW88WdCZGd5NFhWR3RacVQtMB24zQmP8gk9xKadiodvmsrUD6HhhTfIGfrbw4e33kaXWiVzibHyg8CWpgF7SwxMJztinnDizQJDKmR4Ve04o53tw==
Authentication-results: dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=psi.ch;

Good morning

In the mean time there are kernel releases with the fix incorporated:
RHEL8: kernel-4.18.0-553.124.1
RHEL9: kernel-5.14.0-611.55.1

Still I recommend to keep the ESP mitigation due to the new "Fragnesia" variant of this vulnerability:

https://access.redhat.com/security/cve/cve-2026-46300
https://access.redhat.com/security/vulnerabilities/RHSB-2026-003

Kind regards

Konrad

On 5/8/26 10:36, Konrad Bucheli (PSI) wrote:

Hi

Just after Copy Fail another similar issue was found: ⁠Dirty Frag:

https://github.com/V4bel/dirtyfrag

Also here we created a ⁠mitigation guide:

https://linux.psi.ch/admin-guide/dirty_frag_mitigation/

We will announce when there are new kernels available where this issue has been corrected.

Kind regards
Konrad

[[Linux-announce] ] Dirty Frag: next Kernel vulnerability for gaining root access, Konrad Bucheli (PSI), 05/08/2026
- Re: [[Linux-announce] ] Dirty Frag: next Kernel vulnerability for gaining root access, Konrad Bucheli (PSI), 05/18/2026