From Copy Fail to Dirty Frag to Fragnesia and ssh-keysign‑pwn: AI‑driven bug hunters are turning the Linux kernel into a shooting gallery.
Since the last time I wrote about serious (or, at least semi serious) security vulnerabilities in Linux, which was on Wednesday, two additional non-trivial vulnerabilities have been found. If you’re thinking that running Linux isn’t as fun as you remembered, you’re probably not alone.
The first of the latest vulnerabilities was announced on Wednesday, at about the same time I was writing about Tor and Tails latest efforts to push a fix for Dirty Frag out the door.
About Fragnesia
This new vulnerability — the third in two weeks — is called Fragnesia (CVE-2026-46300), and was discovered by William Bowling and his team at V12-Security. It’s yet another page-cache corruption path in the Linux kernel’s networking stack — which seems to be the vector of the month. Although it’s in the same class as Dirty Frag, and affects a similar area in the Linux kernel, it’s a whole ‘nother vuln requiring a whole ‘nother fix.
Like the first two — and the one I haven’t told you about yet — proof of concept code has already been released, so you might as well go ahead and figure that somebody’s already trying to exploit this in the wild.
Writing for ZDNet, Steven Vaughan-Nichols has offered the following as a temporary mitigation, although he adds that if you use it, you won’t be able to use a VPN:
sudo rmmod esp4 esp6 rxrpcsudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/fragnesia.confAnother mitigation, this one from Red Hat, involves disabling unprivileged user namespaces, which could affect rootless containers, sandboxed browsers, and Flatpak:
sudo sh -c 'echo "user.max_user_namespaces=0" > /etc/sysctl.d/dirtyfrag.conf'sudo sysctl --systemBut Wait! It Ain’t Over Yet!
Since yesterday there’s ssh-keysign-pwn (CVE-2026-46333) which can be used to make a root-owned file readable by an unprivileged user.
We first heard about this one before it had a CVE number by way of a blog post from Debian developer Daniel Baumann — the guy who posted the one-click mitigation for Copy Fail and Dirty Frag that I wrote about late last week. He’s already submitted a fix to Deb’s Sid branch, so Debian should have this one fixed in short order, and the Debian derivatives will (hopefully quickly) follow suit.
I figure that other distro families are also hard at work on this one.
This string of four vulnerabilities in about three weeks is due to a new twist on Linus Torvalds “many eyes” open source security philosophy — the twist being that the eyes are now mostly connected to AI. What this means is that, for a while at least, we can expect a lot of this. My guess is that Microsoft is seeing even more vulnerabilities surfacing in Windows, they just don’t have to tell the world about it, and so can keep it on the down low.
Christine Hall has been a journalist since 1971. In 2001, she began writing a weekly consumer computer column and started covering Linux and FOSS in 2002 after making the switch to GNU/Linux. Follow her on Twitter: @BrideOfLinux
Be First to Comment