From 6b54bf8561ccc64dbbd0920e12c350d0285398b1 Mon Sep 17 00:00:00 2001 From: Kurt Garloff Date: Mon, 2 Nov 2026 19:15:38 +0100 Subject: [PATCH 1/2] Fix links. - LWN does not allow non-browser retrievals. Drop link. - github/0xdeadbeefnetworking does no longer exist. Link medium article. Signed-off-by: Kurt Garloff --- blog/2026-05-10-kernel-root-exploits.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/blog/2026-05-10-kernel-root-exploits.md b/blog/2026-05-10-kernel-root-exploits.md index 688951d6eb..a8d5465326 100644 --- a/blog/2026-05-10-kernel-root-exploits.md +++ b/blog/2026-05-10-kernel-root-exploits.md @@ -95,8 +95,7 @@ coalescing. It has gotten CVE-2026-46300. This LPE is unrelated to the others; under certain circumstances, the kernel fails to prevent the dumping of process memory under ptraces, which can be used to read out sensitive data. As it can be used to read e.g. ssh keys, it has been called -[ssh-keysign-pwn](https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn). It has -gotten CVE-2026-46333. +[ssh-keysign-pwn](https://medium.com/@alimansoor1298/ssh-keysign-pwn-the-linux-kernel-bug-that-hands-over-your-ssh-keys-in-a-race-against-death-3a6db3a73f9e). It has been assigned CVE-2026-46333. This vulerability allows local attackers to read sensitive data (Information Disclosure - ID) which may be useful to escalate privileges. @@ -143,7 +142,7 @@ install algif_aead /bin/false The fixes for Dirty Frag are still in development as of May 8. The first fixes have been merged upstream and released in 7.0.5, 6.18.28, 6.12.87, 6.6.138, 6.1.172, 5.15.206 and 5.10.255 but there is -[more to come for rxrpc](https://lwn.net/ml/all/2026050859-ahead-anchovy-05e2@gregkh/). +more to come for rxrpc. Update 2026-05-11: 7.0.6 and 6.18.29 contain this last patch, older kernels don't need it. The responsible disclosure process for Dirty Frag unfortunately failed due to the [patches being spotted](https://www.openwall.com/lists/oss-security/2026/05/07/12), From 10f0f9d2ccc8131084e437ef4cb89dfdf6d72697 Mon Sep 17 00:00:00 2001 From: Kurt Garloff Date: Mon, 2 Nov 2026 19:22:18 +0100 Subject: [PATCH 2/2] medium.com does not like link checkers either. Try korben.info, the article looks reasonable. Signed-off-by: Kurt Garloff --- blog/2026-05-10-kernel-root-exploits.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/blog/2026-05-10-kernel-root-exploits.md b/blog/2026-05-10-kernel-root-exploits.md index a8d5465326..df866b4a5c 100644 --- a/blog/2026-05-10-kernel-root-exploits.md +++ b/blog/2026-05-10-kernel-root-exploits.md @@ -95,7 +95,8 @@ coalescing. It has gotten CVE-2026-46300. This LPE is unrelated to the others; under certain circumstances, the kernel fails to prevent the dumping of process memory under ptraces, which can be used to read out sensitive data. As it can be used to read e.g. ssh keys, it has been called -[ssh-keysign-pwn](https://medium.com/@alimansoor1298/ssh-keysign-pwn-the-linux-kernel-bug-that-hands-over-your-ssh-keys-in-a-race-against-death-3a6db3a73f9e). It has been assigned CVE-2026-46333. +[ssh-keysign-pwn](https://korben.info/en/ssh-keysign-pwn-linux-kernel-flaw-9-years.html). +It has been assigned CVE-2026-46333. This vulerability allows local attackers to read sensitive data (Information Disclosure - ID) which may be useful to escalate privileges.