Dirty Frag Sequel Continues the Streak of Linux Kernel Privilege Escalation Vulnerabilities

Fragnesia, the latest local privilege escalation vulnerability in the same family as Dirty Frag, emerges as an “unintended side effect of one of the patches addressing the original Dirty Frag vulnerabilities” according to the original creator of Dirty Frag, Hyunwood Kim.


This is a companion discussion topic for the original entry at…

Meet Fragnesia, the third Linux kernel vulnerability in a month

Linux admins reeling from handling last month’s CopyFail and last week’s Dirty Frag kernel vulnerabilities have a new headache to deal with: Fragnesia.

“This is a significant vulnerability,” Robert Beggs, head of incident response firm DigitalDefence, told _CSO_. “It is bypassing traditional filesystem permissions that are present and enforced (for example, ‘file is owned by root’, or ‘file is…

Read more →
Yet another Dirty Frag type vulnerability: Fragnesia

Sam James has sent an announcement to the OSS Security mailing list about another local-privilege-escalation (LPE) exploit in the same class as Dirty Frag, called "Fragnesia". From the disclosure:

This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug…

Read more →
Linux kernel maintainers suggest a ‘kill switch’ to protect systems until a zero-day vulnerability is patched

Linux server admins may get the ability to turn off a vulnerable function in the OS kernel until a patch for a zero-day vulnerability is ready, if a proposal from a kernel developer and maintainer is accepted by the open source community.

The idea of a kill switch for privileged operators has been suggested by Sasha Levin, a distinguished engineer at Nvidia and co-maintainer of the long-term…

Read more →
Linux kernel maintainers suggest a ‘kill switch’ to protect systems until a zero-day vulnerability is patched

Linux server admins may get the ability to turn off a vulnerable function in the OS kernel until a patch for a zero-day vulnerability is ready, if a proposal from a kernel developer and maintainer is accepted by the open source community.

The idea of a kill switch for privileged operators has been suggested by Sasha Levin, a distinguished engineer at Nvidia and co-maintainer of the long-term…

Read more →
New Release: Tails 7.7.3

This release is an emergency release to fix a critical security vulnerability in the Linux kernel, as well as security vulnerabilities in Tor Browser and in the Tor client.

Changes and updates

  • Update the Linux kernel to 6.12.86, which fixes Dirty Frag, a vulnerability that could allow an application in Tails to gain administration privileges.

For example, if an attacker was able…

Read more →
Two More Major Linux Vulnerabilities Discovered in the Same Class as Copy Fail

Two new Linux local privilege escalation vulnerabilities, Dirty Frag and Copy Fail 2: Electric Boogaloo were discovered in the same vulnerability class as Copy Fail, affecting most Linux distributions.


This is a companion discussion topic for the original entry at https://www.privacyguides.org/news/2026/05/08/two-more-major-linux-vulnerabilities-discovered-in-the-same-class-as-copy-fail

Daniel Baumann: Debian: Linux Vulnernability Mitigation (Dirty Frag)

After Copy Fail from last week, the new Linux local root privilege escalation of today is Dirty Frag.

For those who can not update to linux >= 7.0.4-1 that was uploaded to sid and contains the needed fixes (backports for trixie are available in trixie-fastforward-backports), or are waiting for backports and updates to older Debian releases, or can’t reboot on short notice, mitigations might be…

Read more →
Page 1