Three Linux kernel memory bugs — 'Dirty Frag', 'Copy Fail' and 'Fragnesia' — reported

The recent Linux alarms are two separate stories that meet in the same place: trust in the host. One is a run of kernel privilege-escalation flaws — Copy Fail, Dirty Frag and Fragnesia — that multiple vendors and security firms say share a page-cache or zero-copy theme. The other is a software supply-chain campaign that Socket said spread a malicious post-install hook through eight Packagist packages and references across more than 700 GitHub repositories. Together, they describe a familiar sequence for defenders: get code onto the box, then turn a low-privilege foothold into root. ### Why are these three kernel bugs being discussed together? Gentoo said on May 19 that “Copy Fail, Dirty Frag, and Fragnesia” were a series of recently discovered Linux kernel privilege-escalation vulnerabilities and part of a broader trend in which flaws are being found and disclosed faster than before. Huntress said the three named bugs all pertain to the Linux kernel’s zero-copy functionality and can let an unprivileged user gain root access after obtaining local access. (theregister.com) Red Hat grouped Dirty Frag and Fragnesia in an ongoing security bulletin updated on May 21. The company said Dirty Frag refers to three issues in the IPsec ESP/XFRM and rxrpc modules, and that Fragnesia is a recently disclosed variant within that set. Red Hat also said the similarities were close enough that Dirty Frag is also referred to as “Copy Fail 2.” ### What do the bugs actually let an attacker do? (gentoo.org) Red Hat said “a user with a local account could trigger the flaws to gain root privileges,” elevating access to that of a system administrator. Huntress said the bugs do not provide remote code execution on their own, but are “privilege-escalation accelerants” that become dangerous once an attacker already has a foothold. Huntress said the flaws abuse trusted memory-handling syscalls and zero-copy mechanisms to alter cached file contents in RAM without changing the file on disk. (access.redhat.com) The Register, in an opinion column published May 23, argued that what links the bugs is shared abuse of the Linux page cache. ### Where do patches and mitigations stand? Gentoo said all supported Gentoo kernels carried the latest Fragnesia v5 patch as of May 19, while warning that some vanilla kernel packages were still vulnerable at the time of writing. (access.redhat.com) The distribution recommended automating kernel upgrades and running the latest stable or LTS kernel because upstream does not reliably backport security fixes to older versions. (huntress.com) Red Hat said RHEL 8, 9 and 10 were affected, along with products that rely on the RHEL kernel, including OpenShift, OpenStack Platform and Red Hat Virtualization. It said mitigations can include limiting local access, keeping SELinux in enforcing mode, running workloads as non-root and restricting debug access, while fixes are being expedited. ### How does the Packagist incident fit into this? (gentoo.org) Socket said its researchers identified a coordinated campaign affecting eight Packagist packages whose upstream repositories were modified to include the same malicious postinstall script. The script attempted to download a Linux binary from a GitHub Releases URL, save it to `/tmp/.sshd`, make it executable and run it in the background. (access.redhat.com) The Hacker News, citing Socket, reported that the malicious versions were removed from Packagist and that GitHub searches found references to the same payload across 777 files. Socket said it had not confirmed how many of those results represented distinct compromises, forks, duplicate artifacts or cached references, but said the confirmed Packagist packages were the clearest evidence of the campaign. (socket.dev) ### What is the practical read-through for Linux operators? Huntress said patching is the most effective long-term fix for the kernel flaws, and Gentoo said administrators should expect more updates. Socket said the Packagist campaign stood out because the malicious code was placed in `package.json`, not `composer.json`, which meant teams focused only on Composer metadata could miss the install-time hook. (thehackernews.com) For operators, the immediate checks are concrete: patch kernels, review whether IPsec or rxrpc-related modules are enabled where not needed, and inspect build and install workflows for post-install scripts that fetch external binaries. Gentoo’s kernel notices, Red Hat’s bulletin RHSB-2026-003, and Socket’s package list are the named places to watch for the next updates. (gentoo.org) (huntress.com)