Forgejo (@forgejo@floss.social)

We believe these findings can be addressed publicly. The security team will open issues where approaches to implement new defensive measurements will be discussed, we believe there's no single answer and as such appreciate the opinion of other Forgejo contributors on this matter.

2/2
Apr 30, 2026, 11:11 PM

https://floss.social/@forgejo/116494296646568723

jvoisin opened 9 Pull Requests:
https://codeberg.org/forgejo/forgejo/pulls?poster=40118&state=all

中国外交部确认，特朗普定于5月13至15日对中国作国事访问。
在访华前，美国财长贝森特5月12日将访问日本，见高市早苗，然后5月13日在韩国首尔同何立峰团队会谈。
（新华社，南华早报）

特朗普将于5月13日抵达北京，对中国作国事访问。14日上午双边会谈，下午参观天坛公园，晚宴。15日茶叙，午宴，离境。
在访华前，美国财长贝森特5月12日将访问日本，见高市早苗，然后5月13日在韩国首尔同何立峰团队会谈。
（新华社，南华早报）

Mythos finds a curl vulnerability

via daniel.haxx.se (author: Daniel Stenberg)

CVE-2024-YIKES：《关于一个病毒恰巧修了一个漏洞的那件事》

- 首先，这是一篇虚构文学！（目前还）不是实际发生的情况。
- 讲述了一个受供应链攻击影响的开源包如何在一系列偶然下被发现以至被修正的故事。
- 讽刺了软件工程领域不时会发生草台班子行为的现状。

nesbitt.io/~

seealso: HackerNews:48086082

#SupplyChain #Meme

🔴 Tanstack 系列包被骇。

- 约 42 个包的 84 个版本受到影响；Tanstack Query (@tanstack/react-query) 未受影响。 [1]
- 在 5/11 安装了受影响版本的设备可能也因此被骇。
- 恶意行为包括收集设备上的凭据，以及向设备用户维护的 npm 包加入恶意代码并重新打包发布等。
- 有用户称，恶意软件会在设备上持续运行，如果监测到其收集的 token 被 revoke，则会清空设备家目录。 [2]

tanstack.com/~

1. GHSA-g7cv-rxg3-hmpx
2. gh:TanStack/router#7383

#Tanstack

日本一名非二元性别申请人，要求将户籍中的称谓关系栏位变更不受男女区分限制的标示。大阪高等法院12日作出裁决，裁定现行强制区分男女的做法，与宪法第14条「法律之下人人平等」之精神相抵触。
https://news.web.nhk/newsweb/na/na-k10015119271000
https://www.nikkei.com/article/DGXZQOUF124W00S6A510C2000000/

nicole mikołajczyk 🔜 linux app summit ➡️ piwo ➡️ gpn (@mkljczk@fediverse.pl)

wdym utm_source=chatgpt.com? you needed chatgpt to link to a blog post?

https://pl.fediverse.pl/objects/00cd1c6d-c421-4672-9573-94a78cce191f

Sovereign Tech Fund invests over €1 million in KDE software development

Investment Amount: €1,285,200.00
Investment Year(s): 2026, 2027

https://kde.org/announcements/sovereign-tech-fund-invests-kde/

Linux 内核本地提权漏洞 Fragnesia 预警

网络安全团队 V12 近期披露了一个名为 Fragnesia 的 Linux 内核通用本地提权漏洞。该漏洞属于“Dirty Frag”类漏洞的新变体，主要利用 Linux XFRM 子系统中 ESP-in-TCP 模式的逻辑缺陷。攻击者通过构造特定 nonce 的 AES-GCM 密钥流，可实现对只读文件页面缓存的任意字节篡改。
实验证明，攻击者无需竞争条件即可将恶意代码注入 /usr/bin/su 等高权限程序的内存页，从而获取 root 权限。受影响范围涵盖 2026 年 5 月 13 日补丁发布前的多个内核版本。建议管理员及时更新内核或通过禁用 esp4/esp6 模块进行缓解，并在清理受影响机器时强制刷新页面缓存。

来源：V12Sec / POC

Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag.

It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.

The technique extends the page-cache write bug class that includes Dirty Pipe: when a TCP socket transitions to espintcp ULP mode after data has already been spliced from a file into the receive queue, the kernel processes the queued file pages as ESP ciphertext. The AES-GCM keystream byte at counter block position 2, byte 0 is XORed directly into the cached file page. By selecting the IV nonce to produce a desired keystream byte, any target byte in the file can be set to any value — one byte per trigger invocation.

The exploit builds a 256-entry lookup table mapping each possible keystream byte to its corresponding nonce, then iterates over a payload, firing the splice/ULP race for each byte that needs changing. It writes a small position-independent ELF stub (setresuid/setresgid/execve /bin/sh) over the first 192 bytes of /usr/bin/su in the page cache, then calls execve("/usr/bin/su") to obtain a root shell. The page cache modification is not backed to disk; the on-disk binary is untouched.

GitHub: https://github.com/v12-security/pocs

Subject: [PATCH net] net: skbuff: preserve shared-frag marker during coalescing

diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 7dad68e3b..9c4e8d331 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -6200,6 +6200,8 @@ bool skb_try_coalesce(struct sk_buff *to, struct sk_buff *from,
          from_shinfo->frags,
          from_shinfo->nr_frags * sizeof(skb_frag_t));
   to_shinfo->nr_frags += from_shinfo->nr_frags;
+  if (from_shinfo->nr_frags)
+    to_shinfo->flags |= from_shinfo->flags & SKBFL_SHARED_FRAG;
 
   if (!skb_cloned(from))
     from_shinfo->nr_frags = 0;

https://lists.openwall.net/netdev/2026/05/13/79

修复补丁

https://lore.kernel.org/all/CANn89i+NMVb5EyfsLEfcBu=R+hrD2NPhrNSUwK3hHBWav68KhQ@mail.gmail.com/

目前尚未合并至 netdev/主线, 社区成员 Hyunwoo Kim <imv4bel@gmail.com> 提出该补丁未处理其他多处类似问题, 并额外提出一个补丁作为追加修复

https://lore.kernel.org/all/agRfuVOeMI5pbHhY@v4bel/

@POTUS
is officially wheels down in Beijing ahead of his historic Summit.

It's the first state visit of a sitting U.S. president to China since President Trump's last visit in 2017.
https://x.com/RapidResponse47/status/2054531743735017724