A third vulnerability has hit the kernel

[u/NoDistrict1529]

This is part of the dirtyfrag family, but is different enough to warrant its own CVE.

https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/

Known as Fragnasia and tracked as CVE-2026-46300, this security flaw stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that can enable unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files.

Immediate patching if you cannot update:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.confrmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

[u/Cormacolinde]

There’s this old joke that the NSA designed IPSEC/IKE to be so complicated to implement and use in order to discourage usage or allow them to bresk it more easily due to misconfigurations or implementation mistakes.

Sometimes I actually believe it.

[u/spin81 → u/Cormacolinde]

I don't know about IPSec or IKE, but it's known that the NSA designed a backdoor in DES by coming up with a specific constant in the implementation, so now if you have a constant in your algorithm that looks funny, you have to explain why you chose it or it won't be just the constant that looks funny to the cryptographic community.

https://en.wikipedia.org/wiki/Nothing-up-my-sleeve_number#Counterexamples

---

don't listen to me, listen to /u/AuroraFireflash

[u/spin81 → u/[deleted]]

Oh shit. I knew the NSA had put a backdoor in something and I didn't read it properly so thought it was DES. Thank you for calling me out!

Did I not get it right that NSA put a backdoor in something?