Full Report
Linux distros are rolling out patches for a new high-severity kernel privilege escalation vulnerability (known as Fragnasia and tracked as CVE-2026-46300) that allows attackers to run malicious code as root. [...]
Analysis Summary
# Vulnerability: Fragnasia Linux Kernel Privilege Escalation
## CVE Details
- **CVE ID:** CVE-2026-46300
- **CVSS Score:** High (Specific numerical score pending, typically 7.8 for local privilege escalation)
- **CWE:** CWE-284 (Improper Access Control) / Logic Bug
## Affected Systems
- **Products:** Linux Kernel
- **Versions:** All Linux kernels released prior to May 13, 2026.
- **Configurations:** Systems where the XFRM ESP-in-TCP subsystem is enabled or the `esp4`/`esp6` kernel modules are loaded.
## Vulnerability Description
Fragnasia is a high-severity logic bug located in the Linux XFRM ESP-in-TCP subsystem. It belongs to the "Dirty Frag" vulnerability class. The flaw allows an unprivileged local attacker to achieve an arbitrary byte-write primitive in the kernel. Unlike many privilege escalation flaws, it does not require a race condition. Attackers leverage this primitive to write data into the kernel page cache of read-only files (such as `/usr/bin/su`). By corrupting the memory-mapped representation of these binaries, an attacker can redirect execution flow to gain a root shell.
## Exploitation
- **Status:** PoC available (Developed by William Bowling of Zellic).
- **Complexity:** Low (Does not require a race condition).
- **Attack Vector:** Local.
## Impact
- **Confidentiality:** High (Full access to system files).
- **Integrity:** High (Ability to modify protected system binaries/files in memory).
- **Availability:** High (Potential for system instability or intentional shut down).
## Remediation
### Patches
- Users must update to Linux Kernel versions released on or after **May 13, 2026**.
- Major distributions (Debian, Ubuntu, RHEL, etc.) are currently rolling out patched kernel builds.
### Workarounds
If immediate patching is not possible, the vulnerable kernel modules can be disabled. **Warning: This will break IPsec VPN functionality.**
Execute the following commands as root:
bash
rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
## Detection
- **Indicators of Compromise:** Unusual modifications to the page cache of system binaries like `/usr/bin/su` or `/usr/bin/sudo`.
- **Detection methods and tools:** Monitor for unauthorized calls to the XFRM/ESP subsystems. Audit local audit logs for unexpected privilege transitions or memory-write attempts targeting the page cache.
## References
- **Project Discovery/PoC:** hxxps[://]github[.]com/v12-security/pocs/tree/main/fragnesia
- **Debian Security Tracker:** hxxps[://]security-tracker[.]debian[.]org/tracker/CVE-2026-46300
- **Netdev Patch Thread:** hxxps[://]lists[.]openwall[.]net/netdev/2026/05/13/79
- **Vulnerability Class Overview:** hxxps[://]www[.]bleepingcomputer[.]com/news/security/new-linux-dirty-frag-zero-day-with-poc-exploit-gives-root-privileges/