Comment on Fragnesia Made Public as Latest Linux Local Privilege Escalation VulnerabilityComments−itintheory4moSounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.−chasil4moRedHat's mitigation is this: $ cat /etc/modprobe.d/dirtyfrag.conf install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false Are those correct for this exploit?https://access.redhat.com/security/vulnerabilities/RHSB-2026...−itintheory4moYep, that's the advice from AWS for the previous set of vulnerabilities:https://aws.amazon.com/security/security-bulletins/2026-027-...That one also includes disabling user namespaces. Could be problematic if they're in use.−LawnGnome4moI don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.−cpach3moFor those who can I would recommend upgrading to Wireguard.
Comments
Sounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.
RedHat's mitigation is this:
Are those correct for this exploit?https://access.redhat.com/security/vulnerabilities/RHSB-2026...
Yep, that's the advice from AWS for the previous set of vulnerabilities:
https://aws.amazon.com/security/security-bulletins/2026-027-...
That one also includes disabling user namespaces. Could be problematic if they're in use.
I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.
For those who can I would recommend upgrading to Wireguard.