Three Linux kernel exploits, same root cause: trusting packet reassembly

Three kernel exploits in eighteen months, all targeting the same mechanism. The Register reports on Dirty Frag, Copy Fail, and Fragnesia: separate vulnerabilities that abuse Linux packet fragment reassembly to escalate privileges. Packet fragmentation splits data across multiple IP packets when the payload exceeds the network’s maximum transmission unit. The kernel reassembles these fragments into the original packet. The exploit pattern is consistent: attackers craft malicious fragments that, when reassembled, corrupt kernel memory or bypass security checks. Dirty Frag arrived in late 2024. Copy Fail followed in early 2025. Fragnesia dropped last week. Different CVE numbers, different triggering conditions, same underlying weakness. The trend matters because fragmentation reassembly is foundational network code. It runs in kernel space, handles untrusted input from the wire, and touches memory management primitives. A bug there is not a niche edge case. It is a high-value target sitting at the intersection of networking and memory safety. Linux has mitigations: namespace isolation, eBPF filtering, stack canaries. None prevent a determined attacker from sending crafted fragments to a reachable system. The kernel must reassemble them. If reassembly logic has a flaw, the game is over. The article suggests this is the start of a pattern, not the end. Kernel developers are auditing fragment handling now, but the code is old, complex, and performance-critical. Refactoring it without breaking existing workloads is hard. Rust rewrites are years away for this subsystem. I am watching how fast distributions ship patches. Fragnesia disclosure to stable kernel fix was eleven days. That is fast by kernel standards, slow by cloud standards. If you run multi-tenant infrastructure or expose services to untrusted networks, the time between public disclosure and your fleet running the patch is the window of risk. The deeper question: how many more fragmentation bugs are waiting in code written when 1500-byte MTUs and 32-bit address spaces were the norm.

---

Source: Dirty Frag, Copy Fail, Fragnesia: A Worrisome Linux Security Trend