If i switch to testing can i switch back to stable at a later date?
You shouldn’t have any problems if you switch back from testing to stable branch while an update on stable will be in progress.
1 Like
Thanks, I only have 1 FlatPak App, No snaps or AppImages, the only custom modifications I’ve done is in the Home Folder and added “export GDK_GL=gles” to the “.bashrc” as without this on Gnome/Nvidia i can not playback video files as i just get an error that i have no OpenGL.
UPDATE:
Well I’m now on testing, had a scare as when logging in it return to the login screen, but 3rd time lucky and it working so far, needed to update some gnome extensions once i was on the Desktop, Just waiting for timeshift to finish making a new testing backup then i can test all is working, Thanks everyone that help with my question.
2 Likes
I have not the slightest clue was is going on here and how this Vulnerability affect us.
Could you or anyone else who understand this, explain this in normal word’s, without this alien language, which im seeing there on the website?
After i visit the website i still don’t understand what im seeing there in the demo.
When this problem exist since 2017, why is there even a Alert right now?
Who cares when the problem is 9 year’s old?
Isn’t it a little overdramatic, to release a big announcement yet?
Or is the alert just there to inform everyone (who may had problem’s already, to show them, there is a work around?)
Why can’t we wait till stable gets patched?
Who is even affected by this? Are there certain program’s involved, who doing some special background command’s that lead to problems?
What this Vulnerability even means? Is there a Data Loss going on? Or can someone remote code execute some command’s to attack us?
1 Like
In simple language, it is an exploitable vulnerability in the cryptography subsystem, which allows an unprivileged user to elevate their privileges to root.
The vulnerability was only discovered fairly recently — i.e. on the 1st of April 2026 — but its cause appears to be a performance-related patch that was applied to the kernel back in 2017.
In layman’s terms, the performance patch was trying to cut a corner by forwarding in-memory data to another process, whereas earlier, the other process was required to fetch its data from the on-disk filesystem.
Well, considering how easily the vulnerability can be taken advantage of, it’s a pretty serious one.
In theory, we can, but theory and practice are often not the same thing. So it would be in most people’s best interest to have the vulnerability patched now.
We’ve pushed out patched kernels for far less urgent vulnerabilities in the past.
Not remotely, but locally, i.e. it is exploitable by anyone with a user account on the system.
5 Likes
@Aragorn @linux-aarhus
Ahh okay i think i got it. Thank you both for explanation. So people should be worried who having a Linux PC/Laptop at workspace and leaving their Device alone, just in case someone else trying to gain root priviliges and mess with their system. Then yes, this vulnerability sucks for that user group.
But for people like me and i think that’s the majority of people who using Manjaro, who using their systems at home, shouldn’t care about this. Who let questionable people inside their home’s and let them intrude our system!? I won’t let them on my device’s anyways.
Or is there still a good example to worrie that a userspace program, gets root access because of this Vulnerability? I don’t think so… maybe if a userprogram updated recently to abuse the vulnerability… but then it would be malware anyways.
So life goes on, but its okay to inform people who might have a problem with that vulnerability.
Not yet, but that option could manifest itself, and perhaps a lot sooner than we think. A.I. is all the rage now, and malware creators are using it as well as other “vibe coders”.
That said, I’ve just checked on my system, and the offending kernel module isn’t even loaded — I don’t use any encryption.
As I said earlier, we’ve pushed out kernel updates for vulnerabilities far less serious than this one, so the responsible thing to do would be to push out a kernel update to the Stable branch.
The fact that the Manjaro developer in charge of the kernels doesn’t deem this necessary and thinks that everything will be fine until the end of the month¹ speaks volumes, in my personal opinion.
¹ We were also promised an update to the Stable branch for late April to early May, and now we’re being told that the Stable branch won’t get updated anymore before the end of May, as again per the decision of one man — who apparently didn’t get the message behind our Manifesto. 
8 Likes
Honestly, I don’t understand what’s driving him, doesn’t he realize that he’s causing harm with his actions? It’s sad to witness such behavior, as he continues to destroy everything that the community has built over the years, even decades. I hope things will get better, as I don’t want to lose a great distribution with a very supportive and responsive community. I haven’t seen such feedback from other distribution communities.
2 Likes
I’m on testing with no encryption and I’m the only user of my rig so the exploit means nothing to me but god help any business running on Stable . Having said that the other situation you mentioned is extremely disconcerting , like watching a ticking time bomb as far as this distro is concerned . I have other distro’s running on my pc but Manjaro is my daily driver and has been my favorite for years , Damned shame this is happening .
1 Like
# For me, at work it is simply forbidden to take a break without logging off!
Is this CVE really that dangerous? What if I boot from my Manjaro USB drive and run a manjaro-chroot? 
This should also work without changing to root:
sudo sh -c 'echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf'
sudo rmmod algif_aead 2>/dev/null || true
Edit: Sorry, it seems that I responded to the wrong person by mistake. Ups!
1 Like
To understand why running it with sudo also fails, let me explain:
foo abc > bar is interpreted by the shell (i.e. the command interpreter). It parses that line and splits it into pieces:
- The program:
foo - The parameters:
abc - Stdout (standard output) redirection:
> bar
Then, the shell will:
- Open the file
barfor writing; - Fork into a new process;
- Set this new process stdout (i.e. the file descriptor 1) to the opened file;
execto executefoowithabcas parameter.
Observe that, in real command-line, sudo is the process being executed by the shell. The sudo program will run echo as root. But also observe that the shell redirection is done by the shell process, which is being executed as the current user. Thus > /etc/modprobe.d/… fails because the current user cannot write to that file/directory.
And that’s why sudo foo bar > /some/path doesn’t work when /some/path is only writable by root.
2 Likes
Well, not really.
If you are a developer you may end up running npm install or pip install to install Node or Python dependencies. That essentially means you are running “arbitrary” code from those repositories. Or you are a gamer and you are running downloaded games. Or you are installing something from AUR. Or you are running docker images.
In all those cases, there is a possibility that some of that downloaded code could include the exploit to silently gain root access in your system. And that’s why everyone SHOULD upgrade (or apply a mitigation) ASAP.
(Okay, sure, there is already a possibility that some code could have access to all of your user-writable files, which is already pretty scary anyway.)
And that’s why a new kernel MUST be released to stable ASAP. How long it takes to release a fix for the stable branch will tell users how serious or trustworthy Manjaro will be.
[EDIT: Stable has been updated: [Stable Update] 2026-05-02 - Kernels, Plasma, GNOME, Mesa, Systemd, VirtualBox, LibreOffice ]
3 Likes
Current stable update includes most kernels patched. Please avoid to use Realtime Kernels for now …
13 Likes
such vulnerabilities would appear more often, then updates to the stable branch would not be delayed))) Thanks to the vulnerability for the update 
5 Likes