Known issues and solutions
This is a wiki post; please edit as necessary.
Please, consider subscribing to the Testing Updates Announcements RSS feed
Please RTFT (Read This Fine Thread) first before reporting the same issues over and over again!
Note: Do not forget to review your .pacnew files:
- https://wiki.manjaro.org/index.php/System_Maintenance/en#Pacnew_and_Pacsave_files
- Check and manage pacnew files
2026-05-23
2026-05-11
A week after Copy Fail, researcher Hyunwoo Kim disclosed a second Linux kernel flaw in the same broad area — IPsec ESP and rxrpc — that they have named Dirty Frag. The bug lives in the in-place decryption fast paths of esp4, esp6, and rxrpc: when a socket buffer carries paged fragments that are not privately owned by the kernel (e.g. pipe pages attached via splice(2)/sendfile(2)/MSG_SPLICE_PAGES), the receive path decrypts directly over those externally-backed pages, exposing or corrupting plaintext that an unprivileged process still holds a reference to.
Like the previous Copy Fail vulnerability, Dirty Frag immediately yields root on all major distributions. Every supported Manjaro release is affected. Dirty Frag chains two distinct kernel bugs, each with its own CVE: CVE-2026-43284 covers the IPsec ESP half (esp4 / esp6), and CVE-2026-43500 (NVD entry pending) covers the rxrpc half. Per Hyunwoo Kim’s public disclosure on oss-security (2026-05-07), the responsible-disclosure embargo was broken before distributions could coordinate, and a working exploit is publicly available. A second public exploit, Copy Fail 2: Electric Boogaloo, targets the same vulnerability under a different name; both reach root through the same esp4/esp6/rxrpc code paths and are blocked by the same fix.
Temporary mitigation
You can neutralize the attack surface by blacklisting the affected modules. None of esp4, esp6, or rxrpc are loaded on a typical workload that does not use IPsec transport mode or AFS, so on most systems this is safe to apply immediately:
sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"
This writes a modprobe config that prevents the three modules from loading, and unloads them if they happen to be loaded already (the rmmod is best-effort and silent if the module isn’t present). To revert, remove /etc/modprobe.d/dirtyfrag.conf.
The Dirty Frag exploit works by corrupting page-cache pages of sensitive files (such as /etc/passwd or /usr/bin/su). If you suspect the system may have already been targeted before you applied the mitigation, drop the page cache so any tampered pages are evicted and the next read comes fresh from disk:
sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'
This is safe to run on a live system — it only frees clean cache and dentry/inode entries — and pairs well with the blacklist above.
2026-05-01
On 29 April 2026, a high local privilege escalation vulnerability in the Linux kernel, tracked as CVE-2026-31431 and named “Copy Fail”, was publicly disclosed. The vulnerability affects Manjaro Linux since 2017. A public proof-of-concept exploit has been released.
We have patched most of our kernels and released them to our testing and unstable branches:
- patched kernels are: 5.10.254+, 5.15.204+, 6.1.170+, 6.6.137+, 6.12.85+, 6.18.22+, 6.19.12+, 7.0-rc7+
- affected kernels are: 6.1.167_rt62, 6.6.133_rt73, 6.12.79_rt17, 6.17.5_rt7 and lower
Temporary Mitigation
Disable the algif_aead kernel module persistently on all affected systems until a patched kernel is available:
sudo su
echo "install algif_aead /bin/false" > /etc/modprobe.d/disable-algif.conf
rmmod algif_aead 2>/dev/null || true
exit
More Information: CERT-EU - High Vulnerability in the Linux Kernel ("Copy Fail")
2026-04-06
udev-usb-sync and kernel 7.0-rc
If you experience slow transfers to USB attached disks, remove the package udev-usb-sync. It is not known why the 7.0-rc kernel causes this. There may be a regression of some sort. Awaiting the final release of the 7.0 kernel before jumping to conclusions.
See [Unstable Update] April 2026 thread for more info
2026-04-23T22:00:00Z
The issue is solved with the release of 7.0 kernel
Previous testing threads: