Instructions how to use kubectl node-shell

Signed-off-by: Kurt Garloff <kurt@garloff.de>

Author: garloff

blog/2026-05-10-kernel-root-exploits.md

@@ -28,14 +28,14 @@ LPEs per year. Most of the time, they affect only a small fraction of users
 and often they are hard to exploit, needing to win a race condition with
 many attempts and sometimes causing crashes in trying (which may not go unnoticed).
 
-We don't report about these LPEs. They get fixed by the upstream Linux kernel
+We don't normally report about these LPEs. They get fixed by the upstream Linux kernel
 developers, shipped as stable updates by the maintainers and shipped to the end
 users via kernel updates from the Linux distributors.
 
 The currently highly visible Linux kernel issues [copy.fail](https://copy.fail/)
 and [Dirty Frag](https://github.com/V4bel/dirtyfrag) are both LPEs (local root
 vulnerabilities). The reason we report about them is that they both affect
-most Linux users and are easy to exploit.
+most Linux users (with kernels from the last 9 years) and are easy to exploit.
 
 Like [Dirty Pipe](https://dirtypipe.cm4all.com/) and before
 [Dirty Cow](https://dirtycow.ninja/), both LPEs rely on improper protection
@@ -70,13 +70,14 @@ this again become root very quickly by overwriting the page cache's view of
 This can be triggered via the IPsec `esp_input` (for both IPv4 and IPv6) as well
 as via the `rxrpc` code. The esp variant requires the privilege to create user
 namespaces and then allows for easy 4 byte writes at a time. It has been assigned
-CVE-2026-43284. The rxrpc variant overwrites 8 bytes, but as these are crypted,
+CVE-2026-43284. The rxrpc variant overwrites 8 bytes and doe not require the
+namespace creation privileges, but as these bytes are crypted,
 the user needs to brute force them in order to achieve a controlled result. This
 variant was assigned CVE-2026-43500.
 
-_Exploiting this vulnerability requires access to the system and the ability
-to execute code there, thus the categorization as LPE, not RCE (remote
-code execution)._
+_Exploiting these vulnerabilities requires access to the system and the ability
+to execute code there, thus the categorization as Local Privilege Escalation (LPE),
+not Remote Code Execution (RCE)._
 
 ## Impact
 
@@ -112,7 +113,7 @@ Linux distributors are currently underway to ship fixed kernels.
 Without a fixed kernel, a workaround is to place a file `copyfail.conf` in
 `/etc/modprobe.d/` with the contents:
 
-```text
+```shell
 # Temporary workaround for copy.fail CVE-2026-31431
 install algif_aead /bin/false
 ```
@@ -129,7 +130,7 @@ manage to ship tested fixed kernels.
 A fully effective workaround is again to prevent loading the affected modules
 by placing another file `dirtyfrag.conf` in `/etc/modprobe.d/`:
 
-```text
+```shell
 # Temporary workaround for Dirty Frag CVE-2026-43284, CVE-2026-43500
 # This breaks IPsec
 install esp4 /bin/false
@@ -203,6 +204,13 @@ into a rescue image (if the cluster runs on OpenStack) to inject an ssh
 key or to use a tool like kubectl-node-shell with the appropriate
 privileges.
 
+```bash
+for node in $(kubectl get nodes | grep -v '^NAME' | awk '{print $1;}') do;
+  kubectl node_shell "$node" -- bash -c 'echo -e "# Temporarily disable algif_aead (copy.fail)\ninstall algif_aead /bin/false" > /etc/modprobe.d/disable-aead-copyfail.conf'
+  kubectl node_shell "$node" -- bash -c 'echo -e "# Temporarily disable esp4, esp6, rxrpc (Dirty Frag)\ninstall esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false" > /etc/modprobe.d/disable-esp46-rxrpc-dirtyfrag.conf'
+done
+```
+
 ## SCS Cloud users
 
 Customers of SCS IaaS clouds are responsible for their own VMs. For VMs