<![CDATA[The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure.]]>The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure.

  1. Copy Fail: Publicity stunt where they claim to have done the right thing, yet didn't bother to tell a single distro vendor, and lied about updates being available.
  2. Dirty Frag: Attempted to do proper coordination, including notifying the linux-distros mailing list. But the embargo was broken, so it was disclosed unexpectedly ahead of time.
  3. Copy Fail 2: Discovered as an n-day by looking at kernel commit logs and Spender noticing that it was copyfail-class

Each path had basically exactly the same outcome (No fixes at publication time). 😂

]]>https://board.circlewithadot.net/topic/94bb46d6-cb94-4253-a480-ce638b1f74e3/the-3-recent-linux-lpes-are-sort-of-interesting-in-that-each-one-took-a-different-path-from-discovery-to-disclosure.RSS for NodeFri, 15 May 2026 02:52:07 GMTFri, 08 May 2026 03:31:00 GMT60<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 17:57:11 GMT]]>@erlenmayr
Using / telling others a CVE ID before it actually exists is a choice, sure.

But is not the recommended way to use CVE.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568557567403806https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568557567403806Wed, 13 May 2026 17:57:11 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 17:33:23 GMT]]>@wdormann https://security-tracker.debian.org/tracker/CVE-2026-46300

]]>https://board.circlewithadot.net/post/https://chaos.social/users/erlenmayr/statuses/116568464022948360https://board.circlewithadot.net/post/https://chaos.social/users/erlenmayr/statuses/116568464022948360Wed, 13 May 2026 17:33:23 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 17:09:45 GMT]]>@AwkwardTuring
Oh, sorry. I suppoi didn't read your message too carefully.
No, it's a separate patch, and therefore it should expected that the Dirty Frag patch does not fix fragnesia. The reasoning is that patches are precise, the mitigation for Dirty Frag is painted with a broad stroke (module level).

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568371046684670https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568371046684670Wed, 13 May 2026 17:09:45 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 17:02:57 GMT]]>@wdormann misunderstanding 🙂 I meant if dirty frag >patch< works for fragnesia

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116568344324216336https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116568344324216336Wed, 13 May 2026 17:02:57 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 16:57:20 GMT]]>@AwkwardTuring
Yes, the Dirty Frag mitigation works to protect against fragnesia CVE-2026-46300 as well.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568322225286895https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568322225286895Wed, 13 May 2026 16:57:20 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 16:49:09 GMT]]>@wdormann oooooh, look at that shiny flickering ASCII animation. No AI-vuln-something marketing content here at all.

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/hillu/statuses/116568290087187202https://board.circlewithadot.net/post/https://infosec.exchange/users/hillu/statuses/116568290087187202Wed, 13 May 2026 16:49:09 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 16:48:39 GMT]]>@wdormann from GitHub: "This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag."

Curious phrasing. Does that mean the patch (not: the mitigation) will work for this as well or no?

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116568288119537945https://board.circlewithadot.net/post/https://infosec.exchange/users/AwkwardTuring/statuses/116568288119537945Wed, 13 May 2026 16:48:39 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 16:40:25 GMT]]>@wdormann wow another? nice

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116568255715093600https://board.circlewithadot.net/post/https://mastodon.social/users/Viss/statuses/116568255715093600Wed, 13 May 2026 16:40:25 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 16:38:59 GMT]]>Are you losing track of the Linux LPEs these days?
Good. Me too.

Here we have fragnesia.

It has been said that CVE-2026-46300 has been assigned for this issue, except that it hasn't. At least not yet.
And in case you don't yet believe that the Linux kernel's handling of CVEs is malicious compliance, note the wording of the CVE mention:

For those that like to track these by CVE ids...

Ubuntu (and Debian?) isn't affected, due to default AppArmor rules.

The same mitigation for Dirty Frag blocks this as well, so if you were on top of Dirty Frag protections, you don't need to worry about fragnesia.

sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; echo 3 > /proc/sys/vm/drop_caches; true"
Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568250110670506https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116568250110670506Wed, 13 May 2026 16:38:59 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 14:16:16 GMT]]>@wdormann I thought so, but not asking means definitely a "no" answer 🙂

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116567688921493322https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116567688921493322Wed, 13 May 2026 14:16:16 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 14:12:28 GMT]]>@wiert
Eh, sorry. It's not past my threshold of caring enough at this point. 😂

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116567673932988022https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116567673932988022Wed, 13 May 2026 14:12:28 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Wed, 13 May 2026 14:10:25 GMT]]>@wdormann

(sorry, I thought I already had posted this one)

I tried multiple connections (we have two ISPs at home - hello redundancy) and sometimes it server side remembers the output language. Not sure why yet as I could not reliably reproduce this. This is intriguing. Any ideas?

//end (for now)

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116567665884134354https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116567665884134354Wed, 13 May 2026 14:10:25 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Tue, 12 May 2026 06:24:37 GMT]]>@wdormann

I just compared these:

```
curl --verbose --cookie-jar - 'https://ikotaslabs.com/news/2026-05-11?page=1&lang-en'
curl --verbose --cookie-jar - 'https://ikotaslabs.com/news/2026-05-11?lang-en'
```

and

```
curl --verbose --cookie-jar - --cookie "lang=en" 'https://ikotaslabs.com/news/2026-05-11?page=1'
```

The first two deliver Japanese returning cookie `lang=ja` ; the last one delivers English with a cookie `lang=en`.

All deliver `<html lang="ja">` which is very odd for the second one.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116560171999955874https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116560171999955874Tue, 12 May 2026 06:24:37 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Tue, 12 May 2026 06:24:13 GMT]]>@wdormann

Odd indeed, and I still think it is caused by the `lang=en` request cookie being absent or present: the Mastodon preview cards are generated server side without sending cookies.

There is a good description of the Mastodon preview cards state of affairs at https://box464.com/posts/mastodon-preview-cards/

(I had to in-place edit `data-mode="dark"` in the html header into `data-mode="light"` to force it to become readable)

The preview request is at https://github.com/mastodon/mastodon/blob/main/app/services/fetch_link_card_service.rb#L56 (search for `Request.new`).

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116560170447803155https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116560170447803155Tue, 12 May 2026 06:24:13 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 20:50:10 GMT]]>@wiert
Eh, I blame their web server.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557913189594310https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557913189594310Mon, 11 May 2026 20:50:10 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 20:29:58 GMT]]>@wdormann maybe it requests it once and without a lang=en cookie set?

The web is full of surprises, not limited to security vulnerabilities (;

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557833704525426https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557833704525426Mon, 11 May 2026 20:29:58 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 20:18:29 GMT]]>@wiert
I mean, even Mastodon itself renders the link in your first reply as Japanese. 🤷‍♂️

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557788599835441https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557788599835441Mon, 11 May 2026 20:18:29 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 19:40:37 GMT]]>@wdormann

That's a nice find.

Just tried in an incognito Window without Google Translate active but with JavaScript active.

- Japanese: https://ikotaslabs.com/news/2026-05-11?page=1
- English: https://ikotaslabs.com/news/2026-05-11?lang=en
- English as well: https://ikotaslabs.com/news/2026-05-11?page=1&lang=en
- English as well: https://ikotaslabs.com/news/2026-05-11?page=1

I think it is setting a lang=en cookie the first time it encounters a lang=en parameter, but does not always return an English translated page unless the lang=en cookie is in the request.

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557639710210199https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557639710210199Mon, 11 May 2026 19:40:37 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 18:28:16 GMT]]>@wiert
Is it though?

Interstingly if I get rid of the page=1 part of your link, it works fine.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557355181516208https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116557355181516208Mon, 11 May 2026 18:28:16 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 18:16:06 GMT]]>@wdormann English version of that post: https://ikotaslabs.com/news/2026-05-11?page=1&lang-en

]]>https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557307373021779https://board.circlewithadot.net/post/https://mastodon.social/users/wiert/statuses/116557307373021779Mon, 11 May 2026 18:16:06 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 15:54:03 GMT]]>@wdormann Ok Siri, how do I temporarily disable the Linux kernel in general

]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116556748760220513https://board.circlewithadot.net/post/https://infosec.exchange/users/nyanbinary/statuses/116556748760220513Mon, 11 May 2026 15:54:03 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Mon, 11 May 2026 15:48:35 GMT]]>And in case Dirty Frag wasn't unpatched enough for you, IKotas labs has found a new variant of Dirty Frag

So far, patches have only landed in today's Linux 7.0.6 and 6.18.29.

Link Preview Image
]]>https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116556727281568564https://board.circlewithadot.net/post/https://infosec.exchange/users/wdormann/statuses/116556727281568564Mon, 11 May 2026 15:48:35 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Sat, 09 May 2026 02:24:49 GMT]]>@wdormann @Lioh I think that refers to the copy fail 2 release, which (from link in top post in this thread, repeated below) seems to be someone who reverse engineered one of the (dirty pipe) bugs from the upstream kernel fix and wrote it up (presumably originally assuming it was already fixed / shipped).

An “embargo” with patches in public is… always going to be fragile. (Looks like “accidental duplicate find” here, because of first copy fail.)

Link Preview Image
oss-security - Copy Fail 2 / Dirty Frag — n-day from public commit, not embargo break

favicon

(www.openwall.com)

]]>https://board.circlewithadot.net/post/https://cloudisland.nz/users/ewenmcneill/statuses/116542242096603572https://board.circlewithadot.net/post/https://cloudisland.nz/users/ewenmcneill/statuses/116542242096603572Sat, 09 May 2026 02:24:49 GMT<![CDATA[Reply to The 3 recent Linux LPEs are sort of interesting in that each one took a different path from discovery to disclosure. on Fri, 08 May 2026 13:56:09 GMT]]>@wdormann @troed @wodny there's so much less daylight than I thought between "a serious process for security professionals" and "oops all 0-day LPEs"

]]>https://board.circlewithadot.net/post/https://mastodon.online/users/ferrix/statuses/116539298221773789https://board.circlewithadot.net/post/https://mastodon.online/users/ferrix/statuses/116539298221773789Fri, 08 May 2026 13:56:09 GMT