[itintheory]

Sounds like this one is in the same kernel modules as dirtyfrag, so the existing mitigations (if in place) are sufficient.

[chasil]

RedHat's mitigation is this:

  $ cat /etc/modprobe.d/dirtyfrag.conf
  install esp4 /bin/false
  install esp6 /bin/false
  install rxrpc /bin/false

Are those correct for this exploit?

https://access.redhat.com/security/vulnerabilities/RHSB-2026...

[itintheory]

Yep, that's the advice from AWS for the previous set of vulnerabilities:

https://aws.amazon.com/security/security-bulletins/2026-027-...

That one also includes disabling user namespaces. Could be problematic if they're in use.

[LawnGnome]

I don't know, but the problem with blocking esp4 and esp6 is that IPsec stops working, as I understand it.

[cpach]

For those who can I would recommend upgrading to Wireguard.