CVE-2026-46300-Fragnesia---TryHackMe-Lab-Project

The project documents the completion and analysis of the Fragnesia (CVE-2026-46300) TryHackME lab, which demonstrates a Linux kernel page -cache corruption vulnerability capable of achieving local privilege escalation through modification of cached file pages without altering files on disk.

Lab Objectives

. Understand the Fragnesia vulnerability chain. . Analyse Linux page-cache corruption techniques. . Observe privilege escalation from an unprivileged user to host root . Understand the role of:

• skb_try_coalesce()
• SKBFL_SHARED_FRAG
• ESP-in-TCP recieve processing
• AES-GCM in-place decryption . Validate mitigation and cleanup procedures.

Environment

Vulnerability Summary

Fragnesia is a Linux Kernel vulnerability that enables deterministic modification of page-cache-backed file pages through the Esp-in-TCP recieve path.

The vulnerability originates from incorrect handling of shared socket buffer fragments during packet coalescing, allowing controlled byte modifications to cached file contents.

Key Characteristics

Exploitation Flow

stage 1 - page cache Corruption

The exploit was compiled and executed from an unprivileged user account.

cd /home/karen/fragnesia

gcc -02 -w fragnesia.c -o exp ./exp

The exploit modified the cached copy of:

/usr/bin/su

Without altering the file stored on disk

Stage 2 - Namespace Root

The exploit created a user namespace and obtained UID 0 within that namespace.

Verification:

whoami
root

However, attempts to access protected resources failed:

 cat /root/flag.txt
 permision denied

This demonstrated that namespace root does not equate to host root.

Stage 3 - Host Root Escalation

After exiting the namespace shaell:

exit
/usr/bin/su

The corrupted page-cache copy of /usr/bin/su executed attacker-controlled code.

Verification:

whoami
root

id
uid=0(root) gid=0(root)

The process now possessed genuine host-level root privileges.

Flag

THM{fragnesia_skb_coalesce_amnesia}

Verification

To verify that the exploit only affected memory:

sha256sum /usr/bin/su

The hash matched the original binary, comfirming that: . Disk file emained unchangrd. . Only the page-cache copy was modified.

Cleanup

The corrupted page-cache entries were removed using:

sudo sh -c 'echo 3 > /proc/sys/vm/ drop_caches'

After cache eviction, /usr/bin/su returned to normal behavior and required authentication.

Security Lessons Learned

• Kernel patches can introduce new vulnerabilities within the same subsystem.
• Page-cache corruption remains a powerful privilege escalation technique.
• Namespace root and host root are fundamentally different security contexts.
• Integrity monitoring based solely on disk hashes may fail to detect page-cache attacks.
• Memory-resident modifications can bypass traditional file integrity controls.

Skills Demonstrated

• Linux Privilege Escalation
• Kernel Vulnerability Analysis
• Page Cache Internals
• User Namespaces
• Linux Process Security
• Exploit Validation
• Security Mitigation Verification
• Incident Analysis

References

TryHackMe – Fragnesia (CVE-2026-46300) Linux Kernel Documentation CVE-2026-46300 Research Materials

author

Ejepu Benedict Amaechi Project completed and documented as partt of hands-on cybersecurity training on TryHackMe.