oss-security - Copy Fail 2 / Dirty Frag — n-day from public commit, not embargo break

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <65e733e1-1db0-4c06-926f-e587e6c10caf@afflicted.sh>
Date: Thu, 7 May 2026 19:10:05 -0400
From: SiCk <sick@...licted.sh>
To: oss-security@...ts.openwall.com
Cc: letters@....net, jzb@....net
Subject: Copy Fail 2 / Dirty Frag — n-day from public commit, not embargo break

Hi, I'm _SiCk

(afflicted.sh, 0xdeadbeefnetwork on GitHub).

  The May 7 LWN piece on "Dirty Frag" raises the question of how the bug 
surfaced before Hyunwoo Kim's May 12 coordinated disclosure.

  At least one of the public artifacts in circulation — my "Copy Fail 2: 
Electric Boogaloo" repo — is an n-day built from the public netdev fix 
commit, not a break from inside the embargo.

Timeline on my end: - Steffen Klassert's fix landed publicly on 
netdev/net.git as commit  f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4.

  Brad Spengler (@spendergrsec) publicly called the commit 
copyfail-class. - I read the commit, recognized the xfrm ESP-in-UDP 
MSG_SPLICE_PAGES no-COW path against shared pipe pages as an LPE 
primitive, and built a PoC.

- Published to GitHub and afflicted.sh on May 7. The repo credits Kim 
and Chen (discovery, upstream fix), Klassert (maintainer fix), Spengler 
(public call-out), and Theori/Xint (original Copy Fail, CVE-2026-31431) 
directly in the README.

I had no contact with anyone on the linux-distros embargo, no awareness 
of the May 12 disclosure date, and no access to Kim's write-up or PoC. 
The work is n-day weaponization from a public upstream commit, which is 
standard practice once a security-relevant fix lands in a public tree. 
Flagging this so parallel n-day work isn't characterized as a leak from 
inside the coordinated process.

  Happy to confirm timeline details if useful.

Copy_Fail2-Electric_Boogaloo Write-up:

https://afflicted.sh/blog/posts/copy-fail-2.html

https://github.com/0xdeadbeefnetwork/Copy_Fail2-Electric_Boogaloo

https://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git/commit/?id=f4c50a4034e62ab75f1d5cdd191dd5f9c77fdff4

My sincere apologies to Hyunwoo Kim It was not my intent to undermine 
his work.

(_SiCk) afflicted.sh

Content of type "text/html" skipped

Download attachment "vxNDzlKwjhHrB3LN.png" of type "image/png" (58571 bytes)

Download attachment "OpenPGP_0xD5BCDCDE32B7C59F.asc" of type "application/pgp-keys" (649 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.