Wilko Meyer via "Development of GNU Guix and the GNU System distribution." <[email protected]> writes: > There's been another LPE vulnearability affecting all kernel versions we > currently ship in Guix, which means there's been two LPEs in total > during the last two weeks: > > - CVE-2026-31431 known as copy.fail (more information at: > https://copy.fail/) > - CVE-2026-43284 known as Dirty Frag (more information at: > https://github.com/V4bel/dirtyfrag) > > copy.fail is fixed as of 2026-04-30 and commit > d3cc0386663ebc122edc051a4bad349097016190 or later thanks to Vagrant and > Rodion who took care of packaging that update round. > > Dirty Frag will be fixed as soon as > https://codeberg.org/guix/guix/pulls/8434 lands on master (currently > requires review, I'll try to build and boot test at least the more > recent LTS kernels at least for x86_64 and arm64 platforms). > > It will probably be a good idea to sent a mail to info-guix addressing > both LPEs and recommendating people to upgrade their systems. I wrote a > draft for such a mail in > https://codeberg.org/guix/guix/issues/8430#issuecomment-14495007.
This sounds like it could result in guix build servers being taken over by someone who submits a PR which runs the exploit during build time - does anyone know whether mitigations are in place? I think it might be worthwhile to temporarily disable building non-whitelisted branches until the build servers are updated
