❌

Visualização de leitura

↗️

Linux Kernel 7.1 Reaches End of Life

✇Cybersecurity News
Por:Do Son

The Linux Kernel 7.1 EOL has officially arrived. Discover the final updates and learn why you must upgrade to the latest stable LTS releases immediately.

Related Posts:

The post Linux Kernel 7.1 Reaches End of Life appeared first on Daily CyberSecurity.

↗️

Darwin-VM Enables Apple Silicon Security Research

✇Cybersecurity News
Por:Do Son

Developer JPRX launched Darwin-VM to emulate Apple Silicon systems. This QEMU-based tool assists security researchers with XNU kernel debugging and analysis.

Related Posts:

The post Darwin-VM Enables Apple Silicon Security Research appeared first on Daily CyberSecurity.

↗️

Fragnesia Linux Kernel Flaw Enables Root Privilege Escalation

✇Firewall Daily – The Cyber Express
Por:Ashish Khaitan

Fragnesia

Security researchers have disclosed a newly identified local privilege escalation vulnerability in the Linux Kernel, dubbed “Fragnesia,” which belongs to the broader Dirty Frag family of flaws. The issue, officially tracked as CVE-2026-46300, affects the Linux Kernel’s XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to escalate privileges to root by corrupting page-cache memory.  The discovery of Fragnesia highlights how fixes for previous Linux Kernel vulnerabilities can unintentionally introduce new attack surfaces. According to researcher Hyunwoo Kim, who previously identified Dirty Frag, Fragnesia emerged as an unintended consequence of patches created to mitigate the original Dirty Frag vulnerabilities.  The vulnerability impacts a wide range of Linux distributions, many of which have already begun rolling out security updates. While a proof-of-concept exploit for Fragnesia is publicly available, researchers have stated that there is currently no confirmed evidence of active exploitation in real-world attacks. 

How Fragnesia Targets the Linux Kernel 

Fragnesia exploits a logic flaw within the Linux Kernel’s XFRM ESP-in-TCP implementation. Specifically, the vulnerability stems from improper handling of shared page fragments during socket buffer (skb) coalescing operations.  The attack abuses a condition where file-backed pages are inserted into a TCP receive queue before the socket transitions into ESP-in-TCP ultra-light protocol (ULP) mode. Once ESP processing is activated, the kernel decrypts queued data in-place. This process creates controlled corruption within the underlying page cache through manipulation of the AES-GCM keystream.  Researchers explained that the exploit leverages user and network namespaces to gain CAP_NET_ADMIN privileges inside an isolated namespace. Attackers can then install a specially crafted ESP security association using NETLINK_XFRM and repeatedly trigger controlled single-byte writes into cached file pages.  Using this approach, researchers successfully demonstrated overwriting the opening bytes of /usr/bin/su with a compact ELF payload. The payload executes setresuid(0,0,0) before launching /bin/sh, ultimately providing attackers with a root shell.  Importantly, the modified data exists only within page-cache memory and does not permanently alter the binary stored on disk. However, researchers warned that exploitation is not limited to /usr/bin/su. Any file readable by the user could potentially be modified, including highly sensitive files such as /etc/passwd. 

Relationship Between Fragnesia and Dirty Frag 

Fragnesia shares several characteristics with Dirty Frag and other recently disclosed Linux Kernel privilege escalation flaws, including Copy Fail. All of these vulnerabilities rely on corruption primitives that enable attackers to tamper with protected memory structures.  Microsoft’s threat intelligence team noted the similarities between Fragnesia and Dirty Frag in its analysis of the vulnerability.  “Similar to Dirty Frag, Fragnesia exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel,” Microsoft stated.  The company further explained:  “The primitive is then used to corrupt the page cache memory of the /usr/bin/su binary, which in turn leads to launching a shell with root privilege. Note that exploitation is not constrained to use the /usr/bin/su binary; it can modify any file readable by the user, including /etc/passwd.”  Microsoft also warned that Copy Fail has already been exploited in the wild. Shortly after Dirty Frag was disclosed, the company indicated that it may also have been leveraged in malicious attacks.  On May 8, Microsoft reported that telemetry from its Defender platform had identified limited activity that could indicate attempted exploitation involving either Dirty Frag or Copy Fail. At the time of publication, however, there were no additional public reports confirming exploitation of Dirty Frag or Fragnesia in active campaigns. 

Why XFRM ESP-in-TCP Matters 

The XFRM ESP-in-TCP subsystem plays a key role in enabling Encapsulating Security Payload (ESP) traffic over TCP connections within the Linux Kernel. Because ESP-in-TCP is used in certain VPN and encrypted networking scenarios, vulnerabilities affecting this component can expose critical systems to local privilege escalation attacks.  Fragnesia demonstrates how flaws in low-level networking components can lead to deterministic page-cache corruption, giving attackers powerful primitives capable of bypassing standard file protections.  Unlike some earlier Linux Kernel privilege escalation flaws, Fragnesia does not require host-level privileges before exploitation. This significantly lowers the barrier for local attackers operating within constrained environments.  Researchers also pointed out that AppArmor restrictions on unprivileged user namespaces, which are enabled by default on Ubuntu systems, may provide partial mitigation. However, additional bypasses could still allow successful exploitation under certain conditions. 

Mitigation and Security Recommendations 

Security experts strongly recommend that organizations apply vendor-provided Linux Kernel patches addressing Fragnesia and the underlying XFRM ESP-in-TCP vulnerability as soon as updates become available.  Until patches are fully deployed, administrators are advised to disable vulnerable modules associated with both Fragnesia and Dirty Frag if they are not required. Recommended commands include:  rmmod esp4 esp6 rxrpc  Administrators can also prevent the modules from loading by creating the following configuration:  printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/fragnesia.conf  Researchers additionally recommend restricting or disabling unprivileged user namespaces wherever operationally feasible. Monitoring systems for suspicious namespace creation, abnormal AF_ALG usage, or unauthorized XFRM manipulation may also help detect exploitation attempts.  If compromise is suspected, administrators should reboot affected systems or clear page-cache contents to remove modified in-memory binaries:  echo 1 | tee /proc/sys/vm/drop_caches  As Linux Kernel developers continue addressing Dirty Frag-related vulnerabilities, Fragnesia serves as another example of how security patches can unintentionally introduce new weaknesses into complex subsystems such as XFRM ESP-in-TCP. 
↗️

How Cloudflare responded to the “Copy Fail” Linux vulnerability

✇The Cloudflare Blog
Por:Chris J Arges · Sourov Zaman · Rian Islam

On April 29, 2026, a Linux kernel local privilege escalation vulnerability was publicly disclosed under the name "Copy Fail" (CVE-2026-31431). Cloudflare’s Security and Engineering teams began assessing the vulnerability as soon as it was disclosed. We reviewed the exploit technique, evaluated exposure across our infrastructure, and validated that our existing behavioral detections could identify the exploit pattern within minutes. 

There was no impact to the Cloudflare environment, no customer data was at risk, and no services were disrupted at any point. Read on to learn how our preparedness paid off. 

Background

Our Linux kernel release process

Cloudflare operates a global Linux server infrastructure at an immense scale, with datacenters located across 330 cities. We maintain a custom Linux kernel build based on the community's Long-Term Support (LTS) versions to manage updates effectively at this volume. At any given time, we may utilize multiple LTS versions from various series, such as 6.12 or 6.18, which benefit from extended update periods.

The community regularly merges and releases security and stability updates which trigger an automated job to generate a new internal kernel build approximately every week. These builds undergo testing in our staging data centers to ensure stability before a global rollout. Following a successful release, the Edge Reboot Release (ERR) pipeline manages a systematic update and reboot of the edge infrastructure on a four-week cycle. Our control plane infrastructure typically adopts the most recent kernel, with reboots scheduled according to specific workload requirements.

By the time a CVE becomes public knowledge, the necessary fix has typically been integrated into stable Linux LTS releases for several weeks. Our established procedures ensure that we have already deployed these patches.

At the time of the "Copy Fail" disclosure, the majority of our infrastructure was running the 6.12 LTS version, while a subset of machines had begun transitioning to the newer 6.18 LTS release.

About the Copy Fail vulnerability

It helps to understand the vulnerability before getting to the response story. A comprehensive write-up can be found in the original Xint Code disclosure post.

AF_ALG and the kernel crypto API

The Linux kernel's internal crypto API manages functions like kTLS and IPsec. Userspace programs access this via the AF_ALG socket family, allowing unprivileged processes to request encryption or decryption. The algif_aead module facilitates this for Authenticated Encryption with Associated Data (AEAD) ciphers.

An unprivileged program follows these steps:

  1. Opens an AF_ALG socket and binds to an AEAD template.
  2. Sets a key and accepts a request socket.
  3. Submits input via sendmsg() or splice().
  4. Executes the operation using recvmsg().

The splice() system call is critical here, as it moves data by passing page cache references.

Memory mechanics: page cache and in-place crypto

The page cache is a shared system cache for file contents. Modifying a page belonging to a setuid binary effectively edits that program for all users until the page is evicted.

The crypto API utilizes scatterlists, which are structures linking various memory pages. In 2017, algif_aead was optimized for in-place operations, chaining destination and reference pages together. This design lacked enforcement to prevent algorithms from writing past intended boundaries.

The vulnerability: out-of-bounds write

When the user executes recvmsg(), the authencesn wrapper in the kernel performs a 4-byte write past the legitimate output region:

By using splice(), an attacker can chain a target file's page cache pages to the scatterlist. The out-of-bounds write then taints the cached file, allowing an attacker to control which file is modified, the offset, and the specific 4 bytes written. This means the attacker can manipulate the following with this exploit:

  • File: Any readable file.
  • Offset: Tunable via assoclen and splice parameters.
  • Value: Controlled via AAD bytes 4-7 in sendmsg()

The exploit, step by step

The default exploit targets /usr/bin/su, a setuid-root binary present on essentially every distribution.

  1. Cache Reference: Open /usr/bin/su as O_RDONLY and read() to populate the page cache. Use splice() on the file descriptor to pass these page cache references into the crypto scatterlist.
  2. Setup: Create an AF_ALG socket, bind() to authencesn(hmac(sha256),cbc(aes)), set a key, and accept a request socket without needing privileges.
  3. Write Construction: For each 4-byte shellcode chunk:
    • sendmsg() with AAD bytes 4–7 containing the shellcode.
    • splice() the binary into a pipe then the AF_ALG socket so assoclen + cryptlen targets the desired .text offset.
  4. Trigger: recvmsg() initiates decryption. authencesn writes its scratch data to the target offset of /usr/bin/su in the page cache. Although the function returns -EBADMSG, the 4-byte write is now in the global page cache.
  5. Execution: Running execve("/usr/bin/su") loads the tainted page cache. Since the binary is setuid-root, the injected shellcode executes with root privileges.

The upstream fix (commit a664bf3d603d) reverts the 2017 in-place optimization, removing the exploit.

How we responded 

When the vulnerability was disclosed, many workstreams started in parallel:

  • Mapping the blast radius: Our security team worked with kernel engineers to determine which kernel versions were vulnerable and assess the potential exposure.
  • Validating coverage: Security reviewed the exploit technique and confirmed that our existing behavioral detections could identify the exploit pattern during authorized internal validation.
  • Proactive threat hunting: Security began searching for signs that the vulnerability had been exploited before it was publicly known, going back 48 hours in our fleet-wide logs.
  • Engineering a mitigation: Kernel engineers began building a runtime mitigation that would protect the fleet without breaking production services.
  • Continuing software updates: Our engineering teams worked on delivering an updated Linux kernel, which required carefully rebooting and rolling it out across our servers.

There was no customer impact at any point during this response.

Validating detection coverage

One of the first things our security team did was confirm that our existing endpoint detection would catch this exploit. Our servers run behavioral detection that continuously monitors process execution patterns. It doesn't rely on knowing about specific vulnerabilities; it watches for anomalous behavior across the fleet.

When our engineers validated the vulnerability internally as part of the response, the detection platform flagged it within minutes. The system linked the entire execution chain—starting at the script interpreter, moving through the kernel’s cryptographic subsystem, and ending at the privilege escalation binary—flagging it as malicious based on fleet-wide behavioral patterns.

This happened without a signature update, without a rule change, and without human intervention. Our behavioral detection coverage existed before we wrote any custom logic for this particular Copy File exploit. 

The confirmation was important because it meant we had coverage before writing a vulnerability-specific rule.

Hunting for exploitation

While our engineering team moved to a more targeted mitigation, our security investigation had been running since disclosure. This is our standard procedure for any critical vulnerability.

Our security team operates on a simple principle for critical vulnerabilities: assume compromise until you can prove otherwise. The investigation started from the assumption that exploitation could have occurred before the vulnerability was public, and we worked systematically to either confirm or rule it out.

The exploit leaves a distinctive trace in kernel logs when it runs. We searched for that trace across our centralized logging infrastructure, covering 48 hours before the vulnerability was publicly disclosed. If someone had exploited this before the world knew about it, we would have seen it.

We pulled access logs for affected systems and reconstructed who connected, when, and what commands they ran. This gave us a complete forensic picture of interactive activity on potentially affected infrastructure.

We checked that system binaries had not been tampered with, validated cryptographic hashes against known-good package manifests, looked for persistence mechanisms, and audited network connections for anything unusual. Everything was clean.

Incident timeline and impact

This graph shows the progress of our mitigation program as it progressed through our infrastructure.

How did we mitigate it?

Because of the long timeframe involved in deploying a patched Linux kernel, we also pursued mitigating this exploit without a reboot.

Removing the module

The bug was in the algif_aead kernel module. Therefore, the simple fix was to just remove this module and disallow it from being reloaded.

This mitigation was therefore exactly what the Copy Fail write-up from the security researchers who identified it recommends.

Unfortunately removing the module would have impacted software that leverages the kernel crypto API.  This meant that we had to figure out a more surgical mitigation.

Bpf-lsm

We’ve already developed and deployed such a tool for this exact scenario: bpf-lsm. Instead of removing the module, this tool leaves it loaded for legitimate users and uses a BPF Linux Security Module program to deny the socket_bind LSM hook for everyone else. This completely blocks the front door for any exploits.

A draft of the eBPF program was put together overnight. Team members picked it up the following morning, ran validations, and made it production-ready. The program is fairly straightforward. On every socket_bind call:

  1. If the socket family is not AF_ALG, allow the call through unchanged.
  2. If the family is AF_ALG, check the calling binary's path against an allow-list of the binaries we know to be legitimate users.
  3. If the binary is on the allow-list, allow the bind. Otherwise, deny it.

To verify the mitigation on a given machine without exploiting it, the Copy Fail write-up gives a one-liner:

On a mitigated machine you get PermissionError: [Errno 1] Operation not permitted (or FileNotFoundError, depending on which mitigation is active) instead of a successful bind.

Rolling it out

Before enabling enforcement, we verified that our known internal service was the sole legitimate AF_ALG user to avoid accidental outages. We used prometheus-ebpf-exporter to hook the socket() syscall and track AF_ALG usage per binary across the fleet. This required no kernel changes and provided aggregate data from hundreds of thousands of servers within hours. Results confirmed the identified service was indeed the only legitimate user.

So the bpf-lsm rollout was deliberately staged in two steps:

  1. Get visibility first. Push the ebpf-exporter config gated by salt. Confirm at the metric layer that the known service is effectively the only thing creating AF_ALG sockets.
  2. Then enforce. Push the bpf-lsm program behind a separate enforcement gate.

In parallel, the upstream backport for our majority LTS line finally became available, and our internal automation built a patched kernel against it.

We started to test the patched kernel in our staging datacenters as soon as possible, then we resumed the longer reboot process in order to fully patch our fleet.

Remediation and follow-up steps

While we were prepared for this scenario, at Cloudflare we’re always learning and improving. Key areas we identified for improvement:

  • Better visibility into kernel-API dependencies. We will review kernel-subsystem usage across production services, so we can continue to quickly mitigate exploits without service disruption.
  • Better runtime mitigation. bpf-lsm is a valuable tool for mitigations, but we want to make this tool even better. This will include looking into faster deployments, better playbooks, and better logging and visibility of the tool. 
  • Reduce attack surface of Linux Kernel. Review and audit our kernel configuration. Proactively identify unused modules or features so that we can remove them from our build entirely.

Conclusion

The "Copy Fail" vulnerability presented a unique challenge for us. Despite our practice of deploying Linux patch updates every two weeks, we remained vulnerable because a month-old mainline fix had yet to be backported to our primary kernel line. Despite that, we were still able to roll out patched kernels within hours of the backport's release. In the interim, bpf-lsm provided a surgical, no-reboot mitigation that secured our fleet. While our initial attempt to disable the problematic module failed, it did so safely within our internal staging environment rather than production, allowing us to identify this dependency.

By the end of the rollout, every machine in our fleet was protected by either a patched kernel or a bpf-lsm program denying the vulnerable code path to non-allow-listed binaries. There was no customer impact at any point during this incident, and we have committed to the follow-up work above to make our response faster and our visibility better the next time something like this lands. Responsible disclosure works, in-kernel visibility tooling pays off in moments exactly like this one, and bpf-lsm continues to be one of the most useful primitives we have for runtime kernel mitigation.

At Cloudflare, critical vulnerability response is a coordinated effort across Security, Engineering, Product, and many other teams. Special thanks to Ali Adnan, Ivan Babrou, Frederik Baetens, Curtis Bray, Piers Cornwell, Everton Didone Foscarini, Rob Dinh, Elle Dougherty, Kevin Flansburg, Matt Fleming, Kimberley Hall, Brandon Harris, Jerry Ho, Oxana Kharitonova, Marek Kroemeke, Fred Lawler, James Munson, Nafeez Nazer, Walead Parviz, Miguel Pato, Evan Pratten, Josh Seba, June Slater, Ryan Timken, Michael Wolf, Jianxin Zeng and everyone else who contributed to the investigation, mitigation, and remediation of Copy Fail. We'd also like to thank the Linux upstream maintainers and Copy Fail researchers whose work helped make a rapid response possible.

❌