What I meant is this: Is Debian the Answer to the Ultimate Question of Life, the Universe, and Everything? The context is that of a new Linux local privilege escalation vulnerability: Dirty Frag. 💣💥

The Dirty Frag shit

NOT AGAIN! After Copy Fail, now Dirty Frag!

① Phoronix, May 7: Dirty Frag Vulnerability Made Public Early: Root Privilege On All Distributions:

This time around there are no patches or CVEs yet for this “Dirty Frag” vulnerability as the embargo was broken early and thus the security researcher went ahead and published earlier than anticipated.

…

More details on Dirty Frag via the oss-security posting. This GitHub repository has more details on Dirty Frag.

…

Alma Linux is among the first Linux distributions out with early patches for testing.

② afflicted.sh: copy fail 2: electric boogaloo. Some technical explanations.

③ Bleeping Computer, May 8: New Linux ‘Dirty Frag’ zero-day gives root on all major distros:

“Dirty Frag is a case that extends the bug class to which Dirty Pipe and Copy Fail belong. Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.”

This kernel privilege escalation affects a wide range of Linux distros, including Ubuntu, Red Hat Enterprise Linux, CentOS Stream, AlmaLinux, openSUSE Tumbleweed, and Fedora, which have not yet received patches.

Update May 08, 09:58 EDT: The two page-cache write vulnerabilities chained by Dirty Frag are now tracked under the following CVE IDs: the xfrm-ESP one was assigned CVE-2026-43284, and the RxRPC is now CVE-2026-43500.

④ 9to5Linux: Dirty Frag Linux Kernel Flaw Allows Local Privilege Escalation, Patch Now:

Until a patched kernel is available, you can mitigate Dirty Frag by blocking the affected kernel modules with a /etc/modprobe.d/dirty-frag.conf file containing:

echo "install esp4 /bin/false" | sudo tee /etc/modprobe.d/dirty-frag.conf
echo "install esp6 /bin/false" | sudo tee -a /etc/modprobe.d/dirty-frag.conf
echo "install rxrpc /bin/false" | sudo tee -a /etc/modprobe.d/dirty-frag.conf

Regenerate the initramfs images with the sudo update-initramfs -u -k all command to prevent the modules from being loaded during early boot. In the case that the modules are already loaded, unload them with the sudo rmmod esp4 esp6 rxrpc 2>/dev/null command.

Nah, I guess I’m going back to using Windows for Workgroups 3.11.

⑤ Linuxiac: After Copy Fail, Linux Now Faces Dirty Frag Privilege Flaw:

Patch availability varies by distribution. AlmaLinux has released patched kernels for versions 8, 9, and 10 in its testing repository, with production promotion pending. Debian’s tracker lists CVE-2026-43284 as fixed only in Debian sid with Linux kernel 7.0.4-1. As of now, Bullseye, Bookworm, Trixie, and Forky remain vulnerable.

Ubuntu has issued mitigation guidance and lists Ubuntu 14.04 LTS, 16.04 LTS, 18.04 LTS, 20.04 LTS, 22.04 LTS, 24.04 LTS, 25.10, and 26.04 LTS as affected. Canonical’s CVE tracker indicates several Ubuntu kernel packages still require evaluation. The fix will be distributed through Linux kernel image packages when available.

Red Hat confirms that Red Hat Enterprise Linux 8, 9, and 10, as well as OpenShift 4, are affected. The company is expediting fixes and will provide product-specific guidance. The issue remains ongoing in its advisory. openSUSE and SUSE are also tracking Dirty Frag with the then-current Leap 16.0 and Tumbleweed kernels affected.

The recommended fix is to apply a patched kernel and reboot. Temporary mitigation from vendors involves disabling vulnerable modules when not required, including blacklisting esp4, esp6, and rxrpc. Some guidance also recommends blacklisting related IPsec compression modules such as ipcomp4 and ipcomp6.

However, this workaround is not suitable for all systems. Disabling these modules may disrupt machines using IPsec VPNs, strongSwan, Libreswan, AFS, RxRPC, or related networking features. Canonical warns that the mitigation affects IPsec ESP and RxRPC functionality, and that disabling only one component leaves the other exploitable.

⑥ The same Linuxiac: Linux Kernel Killswitch Proposed After Recent Vulnerability Disclosures:

Last week, two critical Linux kernel vulnerabilities were disclosed, prompting significant concern within the community. In response, developers are now reviewing a proposal for an emergency “killswitch” mechanism to reduce exposure following public disclosure of serious vulnerabilities.

Sasha Levin, an NVIDIA engineer and Linux stable kernel co-maintainer, submitted the patch. It allows system administrators to temporarily disable a vulnerable kernel function while awaiting a security update.

The concept is simple: if a dangerous code path is identified, the kernel can be instructed to stop using that function. Instead of executing normally, the function would return an error. While this does not resolve the underlying bug, it can block access to the vulnerable path until a patched kernel is available.

⑦ Funny thing, I couldn’t connect to Canonical’s page about the issue while being connected to ProtonVPN. I had to use my real IP to be able to read this: Dirty Frag Linux kernel local privilege escalation vulnerability mitigations.

Nope, I will do exactly nothing. When a new kernel is available, I’ll update to it.

⑧ OTOH, to see how broken Linux is as a project and as a product, read this on Phoronix: Linux Erroneously Thinks Intel Bartlett Lake CPUs Run At 7GHz.

I’m going under a rock.

⑨ UPDATE: Foss Force: A Simple One-Click Mitigation for ‘Copy Fail’ and ‘Dirty Frag’ for Debian, Ubuntu, Mint, and Other Debian‑Based Distros.

The article tells in detail about the mitigations wrapped into a single .deb file by Daniel Baumann, a long-time Debian developer, but it only links to people.debian.org/~daniel/linux-vulnerability-mitigation, without mentioning the original announcement, which is here.

It gives, however, relatively detailed information about this mitigation via screenshots.

Important notes:

  • CVE-2026-31431 only covers Copy Fail, which should already be patched in your Debian kernel: bullseye (security) in 5.10.251-4 and 6.1.170-3~deb11u1, bookworm (security) in 6.1.170-3, trixie (security) in 6.12.86-1, forky/testing in 6.19.14-1, sid in 7.0.4-1. But most Ubuntu versions are still vulnerable to Copy Fail: 25.10 questing, 24.04 LTS noble, 22.04 LTS jammy, 20.04 LTS focal, 18.04 LTS bionic.
  • If you need to use a VPN, do not install the mitigations for CVE-2026-43284 and CVE-2026-43500!

Meanwhile…

🎉 Meanwhile, Debian has patched and fixed CVE-2026-43284 and CVE-2026-43500 as follows:

  • 11 bullseye (security): in 5.10.251-4
  • 13 trixie (security): in 6.12.86-1
  • sid: in 7.0.4-1

Debian 12 bookworm is still vulnerable as of Saturday, May 9, 2026, at 1:00 UTC.

UPDATE: Debian 12 received a fixed kernel: bookworm (security): in 6.1.170-3

At the same timestamp, Ubuntu’s CVE-2026-43284 reads, for all supported LTS versions:

Status: Needs evaluation

ARE YOU FUCKING KIDDING ME, CANONICAL?

I’m taking back my recommendation from January 2025 to use Ubuntu LTS, any flavor of it, because of its swiftness in fixing security vulnerabilities. They have changed for the worse.

Maybe Debian is the Answer to the Ultimate Question of Life, the Universe, and Everything.

KDE woes in Kubuntu 26.04 LTS

I didn’t pay much attention to Dedoimedo when he reported this behavior:

I couldn’t log out of the X11 session and then into Wayland. I mean, you could, but then, you get no panel. Everything else works, but no panel. The only way to get a fully functional Wayland session is if you set SDDM to boot into it. Going from Wayland to X11 works just fine.

I also ignored reports on Reddit that Translucency and Wobbly Windows get enabled after an update.

Well, given that I also installed plasma-session-x11 and wanted to use both Wayland and X11, alternatively, I was struck by the following retarded idiocy. Step by step:

Plasma (X11)

  • I discover that Translucency and Wobbly Windows are enabled.
  • I disable them.
  • I log out, or I reboot (the result is identical), in order to select again Plasma (X11).

Plasma (X11) — after Plasma (X11)

  • Translucency and Wobbly Windows are enabled, but they are ignored by the system!
  • They take effect only after I disable and enable them again.
  • I disable them.
  • If I log out or reboot, the next Plasma (X11) will lead to the same result: the two settings get automatically enabled in System Settings, Window Management, Desktop Effects, but they are disregarded.
  • I log out to select Plasma (Wayland).

Plasma (Wayland) — after Plasma (X11) without reboot

  • Breakage:
    • It takes an eternity for the desktop to show up.
    • No panel.
    • Translucency and Wobbly Windows are enabled, and they really work!
  • I disable Translucency and Wobbly Windows.
  • I reboot in order to select Plasma (X11).

Plasma (X11) — after Plasma (Wayland) with reboot

  • Identical to Plasma (X11) — after Plasma (X11):
    • Translucency and Wobbly Windows are enabled, but they are ignored by the system!
    • I disable them.
  • I reboot in order to avoid the breakage after selecting Plasma (Wayland).

Plasma (Wayland) — after Plasma (X11) with reboot

  • Except for the presence of the panel, the rest is like in the case of Plasma (Wayland) — after Plasma (X11) without reboot:
    • Translucency and Wobbly Windows are enabled, and they really work!
    • I disable them.
  • I log out, or I reboot (the result is identical), in order to select again Plasma (Wayland).

Plasma (Wayland) — after Plasma (Wayland)

  • This is the only case in which Translucency and Wobbly Windows remain disabled!

Bottom line:

  • Plasma (Wayland) after Plasma (Wayland) is the only session in which Translucency and Wobbly Windows remain disabled if the user has disabled them.
  • Plasma (X11), regardless of the nature of the previous session (X11 or Wayland) re-enables but ignores Translucency and Wobbly Windows every single time!
  • Plasma (Wayland) after Plasma (X11) will inherit an automatic re-enabling of Translucency and Wobbly Windows, but this time they work!
  • The logical conclusion: on exit and on entry, Plasma (X11) re-enables Translucency and Wobbly Windows, but it will ignore them if not explicitly set by the user. However, a subsequent Plasma (Wayland) session will honor the automatically enabled Translucency and Wobbly Windows!

This is pure madness!

Did I forget a scenario? I can’t tell right now because my brain is wobbly and mad!

I’m too old for this shit

I can’t do this anymore.

I tried to like GNOME 50 (Wayland) in Ubuntu 26.04, and I used it for weeks even before the official release. With further customizations, it worked rather fine, except for a tiny bug by design. Since I cannot stand oligophrenia, and KDE fixed the respective bug, I switched to Kubuntu 26.04.

Now I’m sick of this shit called Wayland, which is “the future of Linux on the desktop.” But in Kubuntu 26.04, even the X11 session has quirks with automagically enabled desktop effects that may or may not work.

While I still can, this is what I’m going to do:

  • Decision: Exit Kubuntu.
  • Decision: Exit KDE.
  • Decision: Exit Ubuntu.
  • Reminder: GNOME outside Ubuntu was never a choice.
  • Reminder: Xubuntu is catastrophic, so XFCE in Ubuntu is not a practical choice.
  • Reminder: Lubuntu isn’t that great, either.
  • Reminder: Ubuntu MATE is literally dead.
  • Reminder: I hate Cinnamon.

What’s left? From the reasonable XFCE choices (meaning, not Fedora), it’s going to be xebian-trixie-amd64.hybrid.iso:

  • It’s Debian stable (despite the main page only mentioning the sid-based ISO).
  • It only adds a couple of packages for theming.
  • Unlike MX, it doesn’t add its own packages and a gazillion configuration tools that add more bugs and trouble (unreliable repos) than convenience.
  • It’s completely bloat-free not only compared to Debian’s XFCE live ISO but even to Debian XFCE as installed from netinst!
  • Despite XFCE 4.20 having a regression that’s still not fixed, although it was reported on Jan. 1, 2025, it’s still the best compromise. And it’s familiar because it didn’t change much over time.

Should one day XFCE become unavailable for X11 under Linux or X11 be dead, I guess I’ll have a couple of choices:

  • To destroy all the laptops that don’t support whatever Windows will be current then (Windows 13, Windows 2040, or Palantir Windows) and install Windows on the remaining ones.
  • To undergo trepanation, then purchase a MacBook. Further medication will be needed (haloperidol, among others).

So far, notwithstanding all the annoyances introduced by MX (its countless tools are such a mess!), Debian 13 XFCE runs pretty nicely. And I see that they were quick to patch whatever was fixable from Dirty Frag.

I was a fool to trust Ubuntu. Or KDE.

But any choice I make, it only delays the software apocalypse.