Solar Designer <[email protected]> wrote: > On Thu, May 14, 2026 at 12:45:31AM +0900, Hyunwoo Kim wrote:
> > This vulnerability is a path that was accidentally activated _after_ the > > introduction of f4c50a4034e6 (2026-05-05), the patch for CVE-2026-43284 in > > the Dirty Frag chain. > > > > In other words, the effective vulnerability window is from f4c50a4034e6 > > (2026-05-05) to upstream -- approximately 9 days. https://github.com/v12-security/pocs/tree/main/fragnesia claims "All versions affected by dirtyfrag are affected." and simultaneously "Any versions without this patch: https://lists.openwall.net/netdev/2026/05/13/79, so Linux kernels before May 13 2026." This reads to me as different from Hyunwoo's analysis. Is there consensus on which is correct? > On Wed, May 13, 2026 at 11:59:37AM +0100, Sam James wrote: > > v12-security have disclosed "Fragnesia" [0]. Quoting their disclosure: Am I correct in my understanding that this "disclosure" was done solely by dropping the code on GitHub, with no advance notification to the Linux kernel or distros? Does that seem reasonable because it's adjacent to the vulnerability whose coattails it rides? I understand that the realistic utility of embargoes is currently shrinking dramatically, but this "drop it while it's hot" approach to seemingly promote yet another AI vulnerability discovery service is a trend I can't abide. -Jan
