A newly disclosed Linux kernel vulnerability called Fragnesia is raising concerns after researchers confirmed it can give local attackers full root access on several major Linux distributions.
Quick Summary – TLDR:
- Fragnesia is a newly discovered Linux local privilege escalation vulnerability.
- The flaw affects the Linux kernel’s XFRM ESP in TCP subsystem.
- Attackers can gain root privileges by corrupting page cache memory.
- Multiple Linux vendors including Ubuntu, Debian, Red Hat, and SUSE have released advisories.
What Happened?
Security researchers have disclosed details about a new Linux kernel local privilege escalation vulnerability named Fragnesia, tracked as CVE-2026-46300. The flaw is being described as another member of the recently discovered Dirty Frag family of Linux vulnerabilities.
Researchers say the issue allows unprivileged local attackers to gain root access by modifying read only file contents stored inside the kernel page cache. The vulnerability affects the Linux kernel’s XFRM ESP in TCP implementation, a networking feature used for encrypted traffic handling.
🛑 3rd Linux kernel LPE in just ~2 weeks: Fragnesia (CVE-2026-46300) just dropped.
— The Hacker News (@TheHackersNews) May 14, 2026
Attackers can now gain root by corrupting the kernel page cache through a flaw in XFRM ESP-in-TCP.
PoC is public. Major distros have already issued advisories.
Details: https://t.co/s8S9XA3sl1
A New Variant in the Dirty Frag Family
Fragnesia emerged shortly after researchers disclosed the original Dirty Frag vulnerability. According to security researcher Hyunwoo Kim, the issue appeared as an unintended side effect of patches created for earlier Dirty Frag related flaws.
Research from the V12 security team and cloud security company Wiz revealed that the vulnerability abuses improper handling of shared page fragments during skb coalescing inside the kernel networking stack.
V12 said:
Unlike some previous Linux privilege escalation flaws, researchers noted that Fragnesia does not require race conditions or host level privileges to work. That makes exploitation simpler in certain environments.
How the Exploit Works?
The exploit targets the ESP in TCP subsystem within Linux networking components. Researchers explained that attackers can splice file backed pages into a TCP receive queue before enabling ESP processing.
Once encryption processing begins, the kernel decrypts queued data directly in memory. This behavior allows attackers to corrupt the underlying page cache through controlled AES GCM keystream manipulation.
The proof of concept exploit repeatedly triggers single byte writes into cached file pages. Researchers demonstrated replacing the beginning of the /usr/bin/su binary with a small ELF payload that executes:
- setresuid(0,0,0)
- /bin/sh
This eventually gives attackers a root shell without modifying the actual file stored on disk. The malicious changes remain only inside memory through the kernel page cache.
Researchers also confirmed that the exploit uses user namespaces and network namespaces to obtain CAP NET ADMIN privileges within isolated environments.
Major Linux Distributions Respond
Several Linux vendors have already released advisories or mitigation guidance related to the vulnerability. Affected distributions include:
Amazon stated that its Linux distribution is not directly affected because it does not provide the vulnerable espintcp module. However, the company said it will still release additional hardening patches as a defense in depth measure.
Microsoft also urged organizations to patch systems as soon as updates become available.
“A patch is available, and while no in the wild exploitation has been observed at this time, we urge users and organizations to apply the patch as soon as possible,” the company said.
Recommended Mitigations
Security experts recommend several temporary mitigation steps until official patches are fully deployed:
- Disable vulnerable esp4, esp6, and related xfrm/IPsec modules if not required.
- Restrict unprivileged user namespaces where possible.
- Monitor systems for suspicious namespace creation and abnormal privilege escalation attempts.
- Reboot systems or clear page cache memory if exploitation is suspected.
Researchers also noted that AppArmor restrictions used by Ubuntu may provide partial mitigation against successful exploitation attempts.
SQ Magazine Takeaway
I think Fragnesia is another reminder that Linux kernel networking components remain a high value target for attackers. What makes this vulnerability especially worrying is how clean and reliable the exploit appears to be. The fact that attackers can gain root access without touching files on disk makes detection much harder for many security tools. Administrators should treat this as a serious risk and prioritize kernel updates immediately.
