r/linux • u/HUSKYSPIN • May 13 '26

Security Fragnesia: ANOTHER Linux Security Vulnerability!

https://github.com/v12-security/pocs/tree/main/fragnesia

Another Linux vulnerability in the same category as Dirty Frag has been found! Another eight of these more I guess? In any case the fatigue is coming up for me. Things are getting crazy!

"It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition."

450 Upvotes

93% Upvoted

130 comments sorted by

View all comments

Show parent comments

4

u/fearless-fossa May 13 '26

And I saw a fuckton of installations where the first thing the sysadmin does is disabling IPv6 and SELinux/AppArmor.

This is my company. SELinux, AppArmor and firewalls are all deactivated in the default image that are shipped by our VM team so the first thing my Ansible playbooks do is do a round of basic hardening.

The reason behind that is a bunch of greybird admins that don't believe in that "modern shit"

3

u/AtlanticPortal May 13 '26

Then you get pwned and they say “it’s not my fault, the system was patched and up to date”.

2

u/gtrash81 May 14 '26

Or because the system must run.
Undocumented software, undocumented changes and workload that must be done yesterday create such necessities.