news
Linux Vulnerability Mitigations (Bugs With 'Brands', Premature Disclosures)
-
LWN ☛ killswitch for short-term emergency vulnerability mitigation
It seems that we are in for an extended period of the disclosure of
vulnerabilities before fixes become available. One possible way of coping
with this flood might be the killswitch
proposal from Sasha Levin.
-
GamingOnLinux ☛ Linux security flaws Dirty Frag and Copy Fail are a good reminder to stay up to date | GamingOnLinux
Have you run your Linux distribution updates recently? You probably should, because Dirty Frag and Copy Fail are coming for you. Two major Local Privilege Escalation (LPE) security issues have been revealed in a short time, which is not ideal.
-
Ruben Schade ☛ Linux monoculture is just as bad for security
-
SANS ☛ Another Universal Linux Local Privilege Escalation (LPE) Vulnerability: Dirty Frag, (Fri, May 8th)
-
Daniel Baumann: Debian: Linux Vulnerability Mitigation (Dirty Frag)
After Copy Fail [CVE-2026-31431] from last week, the new GNU/Linux local root privilege escalations of today are Dirty Frag (Part 1) aka Copy Fail 2 [CVE-2026-43284] and Dirty Frag (Part 2) [CVE-2026-43500].
For those who can not update to linux >= 7.0.4-1 that was uploaded to sid and contains the needed fixes (backports for trixie are available in trixie-fastforward-backports), or are waiting for backports and updates to older Debian releases, or can’t reboot on short notice, mitigations might be needed.
-
Russell Coker ☛ Russell Coker: Dirty Frag on Debian and SE Linux
Hot on the heels of the Copy Fail vulnerability [1] there is a new vulnerability Dirty Frag [2] (I linked to the Alma GNU/Linux page because it’s the first one I saw and it explains things well).
-
LWN ☛ Four stable kernels with partial fixes for Dirty Frag
Greg Kroah-Hartman has announced the release of the 7.0.5, 6.18.28, 6.12.87, and 6.6.138 stable kernels. These kernels contain a partial fix for the Dirty security flaws. Kroah-Hartman has confirmed that a second patch is required, but it is still in development and has not yet been merged.
-
LWN ☛ More stable kernels with partial Dirty Frag fixes
Greg Kroah-Hartman has released the 6.1.171, 5.15.205, and 5.10.255 stable kernels, quickly followed by 6.1.172 and 5.15.206 kernels.
-
LinuxStans ☛ Your Linux Box Has Been Vulnerable For 9 Years and Nobody Knew
Security researcher Hyunwoo Kim just dropped a bomb on the GNU/Linux community. Meet Dirty Frag, the latest “Dirty” vulnerability that gives attackers root access on basically every major GNU/Linux distribution you’re running right now. And it’s completely unpatched. Even in kernel 7.0.4 that dropped today.
-
Ubuntu ☛ Dirty Frag Linux kernel local privilege escalation vulnerability mitigations
The vulnerabilities do not have CVSS scores assigned in the CVE List or NVD, but are assessed by Canonical to have a CVSS 3.1 score of 7.8, corresponding to a severity of HIGH.