Well, that's lovely [LWN.net]

Well, that's lovely

Posted May 8, 2026 1:10 UTC (Fri) by marekm (subscriber, #174682)
In reply to: Well, that's lovely by dskoll
Parent article: Dirty Frag: a zero-day universal Linux LPE

Exploit fails on Debian 12.13 amd64 after running for a few seconds.
Maybe it's just a bug in the brute-force code?
Works immediately on Debian 11.11 i686 (still in LTS).
Mitigation - create /etc/modprobe.d/dirtyfrag.conf with these 3 lines:

install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false

These modules are not loaded by default, loading them is triggered by the exploit. So if they are already loaded, the exploit may have worked and then rmmod is not sufficient, reboot required to clear the page cache.

It would be interesting to know which applications have legitimate use for these modules and are broken by the mitigation.

Well, that's lovely

Posted May 8, 2026 12:53 UTC (Fri) by grawity (subscriber, #80596) [Link]

ESP is the encrypted tunnel type used by practically every IPsec setup. If you're all WireGuard then you can remove it, but it can't really be removed from the default distribution kernel. Fortunately – as I understand it – disabling unprivileged_userns_clone will mitigate this half.

RxRPC is only used by the kernel's built-in AFS filesystem client (the kafs module) and is safe to remove. Even if you're using AFS (which itself is a bit stale), more often than not you'd be using the out-of-tree OpenAFS or Auristor clients rather than kAFS. (I run my own OpenAFS cell as a hobby, and even in that barebones setup, the in-kernel kAFS just doesn't seem finished.)