I am opening this discussion to ask about the integration timeline for the upstream kernel patches addressing the recently disclosed "dirtyfrag" vulnerability CVE not yet assigned. [image] GitHub - V4bel/dirtyfrag Contribute to V4bel/dirtyfrag development by creating an account o…

On the core of this, this kind of bug needs to go through the kernel's stable process (and once a patch becomes available, this part will happen reasonably quickly), at which point it may or may not be deemed important enough for a maintenance release.

[image] openrouterman: ask about the integration timeline This exploit gets you root privileges on an OS where there's only one user for logging in, root... What's the rush ?

technically true why there are so many vulnerabilities are coming up

Because there are a lot of entities worldwide actively searching for them and increasingly throwing LLMs at this task. Both blackhats/ whitehats, state sponsored 3-letter agencies and their commercial minions, organized crime, researchers, developers trying to harden their code and -increasingly- ra…

[image] openrouterman: opening this discussion to ask about the integration timeline for the upstream kernel patches addressing the recently disclosed "dirtyfrag" vulnerability CVE PRs are already there for main/master... kernel: bump 6.18 to…

Further fixes (new stable kernel bump(s)) for this will be needed, the original patch that was merged in these stable kernels already gained a v2 and a v3 in the mean time, past 6.12.87/ 6.18.28.

[dangerousmusic playing=on]This can be abused immediately, to gain root right via privilege escalation, once you are logged in locally as non-root user on a device that by default in the most recent version still only has a single root user….[dangerousmusic playing=off]

...and you have installed IPsec to your router... (Otherwise the vulnerable module is not there. It is not there by default in OpenWrt, with apparently the exception of the Starfire target.)

As you said, I believe OpenWRT isn't affected in the majority of Cases. I don't think I was even vulnerable on my Desktop or Servers for that Matter, as the related Modules weren't loaded to begin with (but have since been blacklisted in /etc/modprobe.d for Desktop/Server). Linux Kernel Copyfail V…

A new point realse will be created, once there's a fix, just as .4 is being built right now.

Patch for dirtyfrag vulnerability

For Developers

hnyman May 8, 2026, 2:31pm 6

PRs are already there for main/master...