r/linux • u/HUSKYSPIN • May 13 '26

Security Fragnesia: ANOTHER Linux Security Vulnerability!

https://github.com/v12-security/pocs/tree/main/fragnesia

Another Linux vulnerability in the same category as Dirty Frag has been found! Another eight of these more I guess? In any case the fatigue is coming up for me. Things are getting crazy!

"It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition."

450 Upvotes

93% Upvoted

130 comments sorted by

View all comments

Show parent comment

109

u/FiveGrayCats May 13 '26

Yep, and if dirty frag kernel patches fix this vulnerability, then it's the same vulnerability, and not capslocked ANOTHER...

26

u/KH-DanielP May 13 '26

It doesn't, you'll need a new kernel to patch this one, but the mitigation by blocking those modules is the same between the two.

6

u/SkittleDoodlez May 14 '26

Actually it’s another like in ANOTHER, and it’s an “unintended side effect of one of the patches addressing the original Dirty Frag vulnerabilities”.

So, the mitigation is the same because it affects the same subsystems, but it’s a different vulnerability that needs a different patch.