Mitigation for Dirty Frag Linux local privilege escalation vulnerability

[Erulezz]

I have never done so many reboots in the last few weeks

 

[sysdev]

I have never done so many reboots in the last few weeks

I've had disasters with less reboots :/

 

[Driesp]

You can run this to fix without rebooting:

sysctl -w kernel.yama.ptrace_scope=3
echo 'kernel.yama.ptrace_scope=3' > /etc/sysctl.d/99-ptracenull.conf

 

[Richard G]

Looks like the new kernel updates are released, seen them on Alma 9 now.

 

[Ohm J]

There have many reboot in this month, all client now complain on midnight downtime

Last patch I will wait for next month to reboot. Because maybe there have other CVE coming. I'm tried.

 

[Richard G]

all client now complain on midnight downtime

Whahaha difficult clients then. I also reboot like 01.00 or 01.30 but downtime is maximum something like 3 minutes if it takes that long.
We got 2 vps, they don't even take 20 seconds.

Better complaining customers than a root hacked server.
I did them all last night, don't want a rooted server.

 

[dkzr]

For Debian https://forgejo.debian.net/linux/linux-vulnerability-mitigation keeps a nice overview of mitigations. I just manually copy the required changes to my system.

 

[ccto]

F.Y.I. - Another one (CVE-2026-64531 , OVSwrap) -

CVE-2026-64531, also known as OVSwrap, is a Linux kernel local privilege escalation in the Open vSwitch action-validation path

Details and Workaround:

https://tuxcare.com/blog/ovswrap-cve/

OVSwrap (CVE-2026-64531) local root exploit: mitigation for CloudLinux 9, 10, and CloudLinux for Ubuntu - CloudLinux

OVSwrap (CVE-2026-64531): a Linux kernel flaw giving local root on CloudLinux 9, 10 and CloudLinux for Ubuntu. No kernel fix yet; apply the mitigation.

blog.cloudlinux.com

New OVSwrap Linux Kernel Flaw Lets Local Users Gain Root via Open vSwitch

CVE-2026-64531 lets local users exploit Open vSwitch kernel memory corruption to gain root, with a public PoC covering roughly 800 builds.

thehackernews.com