LINUX-VULNERABILITY-MITIGATION(7)

💖 NAME 💖

okay bestie, listen up: linux-vulnerability-mitigation — it's the mitigation toolkit for some Linux kernel security vulnerabilities. 🫶

---

🌸 DESCRIPTION 🌸

so basically the Linux kernel has been going through it lately and picked up a whole bunch of local privilege escalation bugs. not the vibe. 😭 here's the tea on each one, one by one, and yes i put the receipts (links) in because i'm thorough like that. 💅

🎀 CVE-2026-31431: Copy Fail 🎀

Copy Fail (<https://copy.fail/>) is a vulnerability in the Linux kernel that allows unauthorized privilege escalation.

it got disclosed by the security firm Theori to the public on 29 April 2026, and it's fixed as of Linux version 7.0.5 (Debian: 7.0.4-1). slay, patched. ✨

🎀 CVE-2026-43284/CVE-2026-43500: Dirty Frag 🎀

Dirty Frag (<https://github.com/V4bel/dirtyfrag>) is a vulnerability in the Linux kernel that allows unauthorized privilege escalation.

disclosed by Hyunwoo Kim to the public on 7 May 2026, fixed as of Linux version 7.0.6. 👑

🎀 CVE-2026-46300: Fragnesia 🎀

Fragnesia (<https://github.com/v12-security/pocs/tree/main/fragnesia>) is a vulnerability in the Linux kernel that allows unauthorized privilege escalation.

disclosed by William Bowling to the public on 13 May 2026, and fixed as of Linux version 7.0.7. 💜

🎀 CVE-2026-46331: PACKET_EDIT_MEME.c 🎀

PACKET_EDIT_MEME.c aka pedit COW (<https://github.com/sgkdev/packet_edit_meme>) is a vulnerability in the Linux kernel that allows unauthorized privilege escalation.

disclosed by Massimiliano Oldani to the public on 29 June 2026, fixed as of Linux version 7.1. 🔥

🎀 CVE-2026-46333: ssh-keysign-pwn 🎀

ssh-keysign-pwn (<https://github.com/0xdeadbeefnetwork/ssh-keysign-pwn>) is a vulnerability in the Linux kernel that allows reading root-owned files as an unprivileged user. yeah, actual root files, as a normie user. 💀

disclosed by the security firm Qualys to the public on 15 May 2026, fixed as of Linux version 7.0.8 (Debian: 7.0.7-1). 🌸

🎀 CVE-2026-43494: PinTheft 🎀

PinTheft (<https://github.com/v12-security/pocs/tree/main/pintheft>) is a vulnerability in the Linux kernel that allows unauthorized privilege escalation.

disclosed by Aaron Esau to the public on 19 May 2026, fixed as of Linux version 7.1-rc4. ⭐

---

ngl bestie if your kernel is older than any of those versions, that's your sign. go patch. this is not a drill. 🚨

---

🦋 INTERACTIVE USAGE 🦋

so the linux-vulnerability-mitigation package applies mitigations based on what the admin (that's you 🫵) picks through debconf:

sudo dpkg-reconfigure linux-vulnerability-mitigation

the debconf dialog lets you choose the mode, which decides which mitigations actually get run:

• all — enable all mitigations. give me everything. 👑
• auto — automatically install/remove the necessary mitigations for the currently running Linux kernel. it just knows. iykyk.
• manual — manually select mitigations. you're the main character now.
• none — enable no mitigations (noop). literally nothing happens. 💀

if you pick manual, you get shown the list of all available mitigations as a multiselect, and you go wild. 🎀

---

🌈 NON-INTERACTIVE USAGE 🌈

the linux-vulnerability-mitigation package can be preseeded with debconf, like this:

TMPFILE="$(mktemp)"

cat > "${TMPFILE}" << EOF
linux-vulnerability-mitigation linux-vulnerability-mitigation/mode select auto
EOF

cat "${TMPFILE}" | debconf-set-selections
dpkg-reconfigure -fnoninteractive -pcritical linux-vulnerability-mitigation
rm -f "${TMPFILE}"

when you choose manual, you can specify individual mitigations by their CVE number, like this:

TMPFILE="$(mktemp)"

cat > "${TMPFILE}" << EOF
linux-vulnerability-mitigation linux-vulnerability-mitigation/mode select manual
linux-vulnerability-mitigation linux-vulnerability-mitigation/mitigations multiselect CVE-2026-31431, CVE-2026-43284, CVE-2026-43500
EOF

cat "${TMPFILE}" | debconf-set-selections
dpkg-reconfigure -fnoninteractive -pcritical linux-vulnerability-mitigation
rm -f "${TMPFILE}"

---

👑 AUTHORS 👑

linux-vulnerability-mitigation was written by Daniel Baumann <<daniel@debian.org>>. iconic behaviour, honestly. 🫶

---

and that's the whole page bestie, we ate that. source/version: linux-vulnerability-mitigation, Linux — Miscellaneous Information Manual, page title Linux Vu...tigation(7). tysm for reading, now go patch ur kernel fr fr 💖✨🎀