Fragnesia Linux Kernel LPE: Root Access via Page Cache Corruption (CVE-2026-46300, CVSS 7.8)

Introduction

A new local privilege escalation (LPE) vulnerability, codenamed Fragnesia and tracked as CVE-2026-46300, has been identified within the Linux kernel. This flaw permits unprivileged local attackers to obtain root access, making it a significant security issue. The discovery follows closely on the heels of other critical Linux kernel vulnerabilities, demonstrating the ongoing need for rigorous security assessments.

Fragnesia is a variant of the previously identified Dirty Frag LPE, allowing for deterministic page-cache corruption to modify read-only file contents. This mechanism provides a direct path to root privileges, presenting a considerable risk to Linux-based systems. Understanding such critical vulnerabilities is a core function of any cyber threat intelligence platform.

This vulnerability operates within the Linux kernel's XFRM ESP-in-TCP subsystem, a network component. The ability to achieve root access without requiring complex race conditions or host-level privileges makes CVE-2026-46300 an important concern for system administrators and security teams. Proactive measures are necessary to address the risks posed by this class of LPE.

What is CVE-2026-46300 and why is it critical?

CVE-2026-46300, known as Fragnesia, is a local privilege escalation vulnerability found in the Linux kernel's XFRM ESP-in-TCP subsystem. It is critical because it enables unprivileged local attackers to gain root access on affected systems by corrupting the kernel page cache.

The vulnerability was discovered by researcher William Bowling of the V12 security team. It has been assigned a CVSS score of 7.8, indicating a high severity due to its potential for privilege escalation. The underlying mechanism involves a logic bug that permits arbitrary byte writes into the kernel page cache of read-only files. This process does not necessitate a race condition, making exploitation more deterministic and reliable for an attacker.

Fragnesia shares operational similarities with Copy Fail and Dirty Frag (also referred to as Copy Fail 2). These are other prominent Linux kernel vulnerabilities. These LPEs function by achieving a memory write primitive in the kernel, often used to corrupt the page cache memory of critical binaries such as /usr/bin/su. This corruption allows an attacker to manipulate file contents and subsequently execute code with elevated privileges. For further context on related issues, refer to discussions on the Dirty Frag privilege escalation. Such vulnerabilities are a primary concern for supply-chain risk monitoring, given the pervasive use of Linux in various infrastructure components.

Which Linux distributions are affected by Fragnesia?

Multiple major Linux distributions are confirmed to be affected by CVE-2026-46300. A range of advisories have been issued by their respective maintainers. The broad impact requires swift action across diverse environments.

Advisories confirming the vulnerability and detailing mitigation steps have been released by the following distributions:

  • AlmaLinux
  • Amazon Linux
  • CloudLinux
  • Debian
  • Gentoo
  • Red Hat Enterprise Linux
  • SUSE
  • Ubuntu

The widespread nature of this vulnerability across popular Linux distributions shows the importance of timely patch management and continuous security assessment. Organizations should consult their specific distribution's security advisories for the most accurate and up-to-date information regarding affected kernel versions and available updates.

Exploitation and Impact of CVE-2026-46300

The exploitation potential of CVE-2026-46300 is substantial. It allows local attackers to gain root privileges through a deterministic page-cache corruption primitive. This enables the modification of read-only file contents, which can be used to execute malicious code with full system control. A proof-of-concept (PoC) exploit for Fragnesia has been publicly released by V12, demonstrating the feasibility of an attack.

At the time of its disclosure, no in-the-wild exploitation of CVE-2026-46300 had been observed. However, the availability of a PoC increases the probability of future exploitation by malicious actors. The impact of a successful LPE can be profound, allowing an attacker who has already gained initial access to a system to elevate their privileges to the highest level. This elevation is often a critical step in various attack chains, including data exfiltration, system compromise, or the deployment of real-time ransomware intelligence threats.

The broader threat environment indicates an active market for such vulnerabilities. Reports note a threat actor identified as "berz0k" advertising a zero-day Linux LPE exploit on cybercrime forums for a significant sum. This zero-day is described as a Time-of-Check Time-of-Use (TOCTOU) vulnerability, capable of stable local privilege escalation without causing system crashes, and using a shared object (.so) payload dropped into the /tmp directory. Such activities are typically tracked through dark web monitoring service and underground forum intelligence, often supplemented by telegram threat monitoring for quick dissemination of new exploits. PurpleOps' capabilities in breach detection are crucial for identifying such post-exploitation activity. The ultimate impact could extend to significant reputational damage, making brand leak alerting a relevant concern for affected organizations.

Mitigation and Patches for Fragnesia

Mitigating CVE-2026-46300 primarily involves applying available patches to upgrade the Linux kernel. A patch for Fragnesia has been released, and users are advised to apply it as soon as possible to address the vulnerability. System administrators should ensure that their Linux systems are updated to the latest kernel versions provided by their respective distribution maintainers.

For organizations where immediate patching is not feasible, several interim mitigation strategies can be employed. These steps aim to reduce the attack surface and potential for exploitation:

  • Disable XFRM ESP-in-TCP functionality: This includes disabling esp4, esp6, and any related xfrm/IPsec features within the kernel configuration. This action directly targets the vulnerable subsystem.
  • Restrict local shell access: Limiting unnecessary local shell access can contain the impact of an attacker who has already gained a foothold on a system, reducing opportunities for local privilege escalation.
  • Harden containerized workloads: For environments utilizing containers, applying stricter security policies and configurations can help isolate workloads and prevent LPEs from affecting the underlying host system.
  • Increase monitoring for abnormal privilege escalation activity: Implementing enhanced logging and breach detection mechanisms can help identify suspicious processes attempting to gain elevated privileges. This allows for rapid response to potential exploitation attempts.

It is important to note that customers who have already applied mitigations for the related Dirty Frag vulnerability may not require additional immediate action until specific patched kernels for CVE-2026-46300 are released. Red Hat has indicated that it is assessing whether existing Dirty Frag mitigations extend to Fragnesia. For detailed information on precursors to this vulnerability, refer to the Dirty Frag Linux vulnerability. While AppArmor restrictions on unprivileged user namespaces might provide a partial defense, successful exploitation could still occur if bypasses are identified and implemented. Using a live ransomware API for continuous vulnerability data can inform prioritization of patches and defensive measures.

Technical Takeaways

  • CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation (LPE) vulnerability with a CVSS score of 7.8.
  • It resides in the XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to gain root access.
  • The vulnerability uses deterministic page-cache corruption, similar to Dirty Frag and Copy Fail.
  • A public proof-of-concept (PoC) exploit has been released, but no in-the-wild exploitation is confirmed.
  • Affected distributions include AlmaLinux, Amazon Linux, CloudLinux, Debian, Gentoo, Red Hat, SUSE, and Ubuntu.
  • Mitigation involves applying kernel patches or disabling XFRM ESP-in-TCP functionality, restricting local access, and enhancing monitoring.