AISaaSFitnessStocksCryptoForexEcomReal EstateMarketingMoneyGlobal
SaaS & Software·May 19, 2026

Copy Fail, Dirty Frag, and Fragnesia kernel vulnerabilities

Article URL: Comments URL: Points: 94 # Comments: 32

Hacker News1 min readSingle source
Copy Fail, Dirty Frag, and Fragnesia kernel vulnerabilities
Image · Hacker News
The gist
5-point summary · 1 min

Article URL: Comments URL: Points: 94 # Comments: 32

  • The Linux kernel has recently been facing a series of discovered privilege escalation vulnerabilities, starting with the Copy Fail vulnerability and followed by subsequent vulnerabilities in the same spirit (Dirty Frag, Fragnesia).
  • This development is part of a general trend where vulnerabilities are being found - and disclosed - faster than before.
  • The Gentoo Linux Kernel and Distribution Kernel teams are doing their best to keep Gentoo kernels secure.
  • As example, while upstream kernel releases are still vulnerable to Fragnesia, the respective Gentoo kernels feature fixes from day one.
  • Other kernel packages may carry fixes, but they usually are slower to be updated.

The Linux kernel has recently been facing a series of discovered privilege escalation vulnerabilities, starting with the Copy Fail vulnerability and followed by subsequent vulnerabilities in the same spirit (Dirty Frag, Fragnesia). This development is part of a general trend where vulnerabilities are being found - and disclosed - faster than before. We expect it to continue, at least for the short-term. The Gentoo Linux Kernel and Distribution Kernel teams are doing their best to keep Gentoo kernels secure. This includes both packaging the latest upstream releases as soon as possible, and backporting additional vulnerability fixes or mitigations whenever they become available. As example, while upstream kernel releases are still vulnerable to Fragnesia, the respective Gentoo kernels feature fixes from day one. At the time of writing, all supported Gentoo kernels feature the latest Fragnesia v5 patch. Please expect more updates. We recommend exploring ways to automate upgrading your kernel. Please note that only sys-kernel/gentoo-kernel, sys-kernel/gentoo-kernel-bin and sys-kernel/gentoo-sources packages are security-supported. The vanilla kernel packages are vulnerable at the moment. Other kernel packages may carry fixes, but they usually are slower to be updated. Additionally, we recommend running the latest kernel version (~arch or latest stable LTS), as upstream does not reliably backport security fixes to older versions.

Integrity note  ·  Xela does not rewrite or paraphrase article content. The excerpt above is the source publication's own words, sanitized for display. For the full piece — including any quotes, charts, or images — read it at Hacker News. Xela's rewritten version is off for this story, so there's no editorial angle attached — you're getting the source's reporting unfiltered. When the rewrite is on, we add a What this means block underneath with the operator/trader takeaway.

What people are saying

Discussion

Hot takes

0/280

Loading takes…

Comments

Discussion · 0

Sign in to comment, like, and save articles.

Sign in

Loading comments…

Keep readingSaaS & Software desk
See all in SaaS →
Show HN: Draco – A single-binary, self-hostable Firecrawl alternative in Rust
·

Show HN: Draco – A single-binary, self-hostable Firecrawl alternative in Rust

Scraping modern websites has become a massive headache. You basically have two choices: pay for an expensive API like Firecrawl/Browserbase, or run a fleet of headless Chrome instances that eat 1GB of RAM per page and still get blocked by Cloudflare. I built Draco to fix this. It’s a fast, single-binary web scraper written in Rust. You point it at a URL, and it spits out perfectly clean Markdown or structured JSON for LLMs. The secret sauce is that it doesn't just boot a browser for every request. It uses a tiered escalation engine: Tier 1 (Stealth Fetch): Draco uses a custom TLS/JA4 fingerprint to perfectly mimic a real browser's network signature at the packet level. It turns out a lot of anti-bot walls will let you right through if your handshake looks correct. In my benchmarks against sites like Cloudflare and Target, Playwright ate ~500MB of RAM and timed out. Draco bypassed them in under a second using just 20MB of RAM. Tier 2 (V8 Isolate): If it hits a React/Next.js SPA that needs rendering, Draco boots an in-process V8 engine in single-digit milliseconds. It hydrates the DOM and intercepts the hidden JSON APIs the page is calling—giving you the raw data without the overhead of a graphical browser. Tier 3 (Real Browser): If it hits an absolute wall, it seamlessly falls back to detecting and driving a real browser on your machine. I also built in all the tooling to make it a complete drop-in replacement for the hosted services: Daemon Mode: Run draco serve and you get a persistent HTTP server with a Firecrawl-compatible REST API. You can swap out your API keys and self-host immediately. Built-in MCP Server: It natively exposes a Model Context Protocol server so you can plug it directly into Claude Desktop or your AI agents. Web Search: Built-in parallel multi-engine web search (bypassing the need for a Google Search API key). Interact Mode: Drive a page statefully like a devtools console, persisting cookies across navigations(for LLM's mainly). It’s completely open source (MIT/Apache-2.0). I just wanted to put this out there for anyone tired of fighting headless Chromium or paying per-page scraping costs. Grab the binary and throw a difficult URL at it. Note that it's still a WIP so there might be some unexpected breakages of uncommon sites but for the most part its quite capable, it can handle cf-protected sites and heavy SPA's while everything else fails partially or completely while taking longer or more resources. (tested on example.com, hackernews, cloudflare, glassdoor, bluff.com, target.com, stake.com and thrill.com) ┏━━━━━━┳━━━━━━━━━━━━━━━━┳━━━━━━━┳━━━━━━┳━━━━━━━━━━┳━━━━━━━━━┓ ┃ Rank ┃ Tool ┃ Score ┃ Pass ┃ Avg Time ┃ Avg RAM ┃ ┡━━━━━━╇━━━━━━━━━━━━━━━━╇━━━━━━━╇━━━━━━╇━━━━━━━━━━╇━━━━━━━━━┩ │ #1 │ Draco │ 769.7 │ 8/8 │ 3.45 │ 216.50 │ │ #2 │ Obscura │ 384.5 │ 4/8 │ 2.68 │ 87.59 │ │ #3 │ BrowserOxide │ 373.4 │ 4/8 │ 6.42 │ 105.95 │ │ #4 │ Playwright │ 342.2 │ 4/8 │ 1.71 │ 535.07 │ │ #5 │ Bouncy │ 196.6 │ 2/8 │ 0.59 │ 19.38 │ └──────┴────────────────┴───────┴──────┴──────────┴─────────┘ Repo: Comments URL: Points: 8 # Comments: 1

Hacker NewsSingle source
AI Mania: From Tulips to Tokens
·

AI Mania: From Tulips to Tokens

Article URL: Comments URL: Points: 34 # Comments: 24

Hacker NewsSingle source
EU Age Verification Project Mandates Hardware-Bound Attestation
·

EU Age Verification Project Mandates Hardware-Bound Attestation

Article URL: Comments URL: Points: 30 # Comments: 13

Hacker NewsSingle source
Show HN: Make your Framework 12 sound like a creaky door
·

Show HN: Make your Framework 12 sound like a creaky door

I was poking through the iio devices on my Framework the other day and turns out Framework 12s have a pretty accurate hinge angle sensor! So I made a version of LidAngleSensor ( ) but for the Framework 12 on Linux, so you can make your hinge sound rusty

Hacker NewsSingle source
Newsletter

Track saas & software every morning.

Daily digest tuned to this beat. The 5 stories most worth your time. Unsubscribe anytime.