Re: Linux kernel LPE ("fragnesia", copyfail 3.0)

[Jan Schaumann <jschauma () netmeister org>]

Solar Designer <solar () openwall com> wrote:

> On Thu, May 14, 2026 at 12:45:31AM +0900, Hyunwoo Kim wrote:

> > This vulnerability is a path that was accidentally activated _after_ the introduction of f4c50a4034e6 (2026-05-05), 
> > the patch for CVE-2026-43284 in the Dirty Frag chain.
> >
> > In other words, the effective vulnerability window is from f4c50a4034e6 (2026-05-05) to upstream -- approximately 9 
> > days.

https://github.com/v12-security/pocs/tree/main/fragnesia
claims "All versions affected by dirtyfrag are
affected." and simultaneously "Any versions without
this patch:
https://lists.openwall.net/netdev/2026/05/13/79, so
Linux kernels before May 13 2026."

This reads to me as different from Hyunwoo's analysis.

Is there consensus on which is correct?


> On Wed, May 13, 2026 at 11:59:37AM +0100, Sam James wrote:
> > v12-security have disclosed "Fragnesia" [0]. Quoting their disclosure:

Am I correct in my understanding that this
"disclosure" was done solely by dropping the code on
GitHub, with no advance notification to the Linux
kernel or distros?  Does that seem reasonable because
it's adjacent to the vulnerability whose coattails it
rides?

I understand that the realistic utility of embargoes
is currently shrinking dramatically, but this "drop it
while it's hot" approach to seemingly promote yet
another AI vulnerability discovery service is a trend
I can't abide.

-Jan