Copy Fail 2: Electric Boogaloo
Comments
alecco
cassianoleal
How is this different from Dirty Frag [0]?
It seems to use the same vector.
auscompgeek
From what I can gather it is the exact same vulnerability.
cpach
Does anyone know how to mitigate this one? Is it sufficient to disable the esp4/esp6/rxrpc modules?
nonamesleft
sysctl kernel.unprivileged_userns_clone=1 keeps on giving.
sickthecat
Yes. Giving me a massive... Well.. Dopamine rush.
Mindless2112
How much pain must there be until people realize we actually do need memory safety?
delamon
How would've memory safety helped here?
Mindless2112
In CHERI, for example, pointers have permissions. The pointer to the COW memory would not have the "write" permission.
I could be misunderstanding the bug, of course.
delamon
If you "forget" to mark COW memory pointer as no-write, the net effect would be same, would it not? If I'm reading the diff correctly, the problem was that code missed to mark some pages as shared (aka no-write).
Mindless2112
A fair point...
I thought the bug was a missing check for the COW flag, but looking at it again it seems it was missing both setting and checking the flag.
delamon
Apparently it is both...
tatersolid
Because “Page-cache write into any readable file” is a memory safety bug? All of these recent Linux LPEs are memory safety issues.
People are blaming the wrong guy for breaking the embargo but via this blog post [1]:
> on 2026-05-05 Steffen Klassert pushed f4c50a4034 to netdev/net.git with Cc: stable@vger.kernel.org.
Once the fix is out it's usual for researchers to race to make the first exploit out of it.
[1] https://afflicted.sh/blog/posts/copy-fail-2.html