Hi Guix, There's been another LPE vulnearability affecting all kernel versions we currently ship in Guix, which means there's been two LPEs in total during the last two weeks:
- CVE-2026-31431 known as copy.fail (more information at: https://copy.fail/) - CVE-2026-43284 known as Dirty Frag (more information at: https://github.com/V4bel/dirtyfrag) copy.fail is fixed as of 2026-04-30 and commit d3cc0386663ebc122edc051a4bad349097016190 or later thanks to Vagrant and Rodion who took care of packaging that update round. Dirty Frag will be fixed as soon as https://codeberg.org/guix/guix/pulls/8434 lands on master (currently requires review, I'll try to build and boot test at least the more recent LTS kernels at least for x86_64 and arm64 platforms). It will probably be a good idea to sent a mail to info-guix addressing both LPEs and recommendating people to upgrade their systems. I wrote a draft for such a mail in https://codeberg.org/guix/guix/issues/8430#issuecomment-14495007. -- Kind regards, Wilko Meyer
