🛡️ CVE-2026-46300 - Fragnesia

A Clean & Deadly Page-Cache Attack

Variant of the "Dirty Frag" family

📌 Overview

CVE-2026-46300 (Fragnesia) is a high-severity logic flaw in the Linux kernel's socket buffer handling (skb_try_coalesce()) within the XFRM/ESP-in-TCP subsystem (espintcp ULP).

An unprivileged local attacker can achieve arbitrary byte writes into the kernel page cache of any readable file — including system binaries like /usr/bin/su — leading to reliable local root privilege escalation.

✨ Key Highlights

• ✅ No race condition required
• ✅ Works purely in page cache (on-disk files untouched)
• ✅ Uses splice() / sendfile() + controlled AES-GCM decryption
• ✅ Public Proof-of-Concept available
• ✅ Affects most major Linux distributions

🛠 Demo

Root Cause: Improper propagation of the SKBFL_SHARED_FRAG marker when coalescing socket buffers, allowing attacker-controlled decryption to corrupt page-cache pages.

🎯 Impact

🛡️ Mitigation

1. Update (Recommended)

Update to the latest patched kernel from your distribution.

2. Immediate Workaround

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/fragnesia.conf"
sudo rmmod esp4 esp6 rxrpc 2>/dev/null || true

3. Drop Page Cache (if suspicious)

sudo sh -c 'echo 3 > /proc/sys/vm/drop_caches'

📥 Proof of Concept

Repository: v12-security/pocs - Fragnesia

⚠️ For educational and defensive purposes only.

📚 References

• AlmaLinux Security Blog
• Ubuntu Security Notice
• Red Hat Security Advisory
• Linux netdev mailing list patch discussion