There's apparently another Linux LPE

Reply to There's apparently another Linux LPE on Sun, 17 May 2026 20:42:37 GMT

wdormann@infosec.exchange — Sun, 17 May 2026 20:42:37 GMT

Also, the Dirty frag mitigation protects against this variant as well:

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"

Reply to There's apparently another Linux LPE on Sun, 17 May 2026 18:45:56 GMT

studiolo_rb@mastodon.online — Sun, 17 May 2026 18:45:56 GMT

@wdormann And there I was, hoping for a relaxed week

Reply to There's apparently another Linux LPE on Sun, 17 May 2026 16:29:01 GMT

wdormann@infosec.exchange — Sun, 17 May 2026 16:29:01 GMT

Apparently exploitation requires CONFIG_RXGK, which most distros don't ship

Except for Fedora.
Or another distro that is running the mainline Linux kernel.

Reply to There's apparently another Linux LPE on Sun, 17 May 2026 15:58:51 GMT

decio@infosec.exchange — Sun, 17 May 2026 15:58:51 GMT

@wdormann Confirmed same experience on recent distros.

Apparently the trick is it needs CONFIG_RXGK compiled in, which most distros don't ship.
Kernel 6.8 on Ubuntu 24.04? Nothing.

But on mainline kernel 7.0.0 it works (slow but solid):
96/96 bytes whoami → root