---

⚠️ Ethical & Legal Warning This tool is intended solely for legitimate and authorized security testing — contracted pentests, lab/CTF environments, or your own assets. Unauthorized use on systems without the owner's permission is a criminal offense (UU ITE, Computer Fraud and Abuse Act, etc.). The user bears full responsibility.

---

📖 Vulnerability Summary

CVE-2026-46300 is a Local Privilege Escalation (LPE) vulnerability in the Linux kernel caused by a regression in skb_try_coalesce() that leads to page-cache corruption, exploited through the XFRM ESP-in-TCP (espintcp) subsystem.

Item	Detail
CVE	CVE-2026-46300
Type	Local Privilege Escalation (LPE)
Component	Linux kernel — page-cache + XFRM ESP-in-TCP (espintcp)
Root Cause	skb_try_coalesce() regression → memory/page-cache corruption
Prerequisites	3 conditions must be met (see audit table)
Impact	Non-privileged user → root

This repository contains 2 components:

File	Function
fragnesia.sh	Audit scanner — checks the 3 prerequisites, then offers exploit execution if the target is vulnerable
fragnesia.c	LPE exploit — exploit source code compiled & run by the script

---

🏗 Workflow

┌───────────────────────┐
│   fragnesia.sh        │
│   Audit: 3 checks     │
└──────────┬────────────┘
           ▼
   CHECKS_TRIGGERED > 0 ?
   ┌──────┴───────┐
   │ Yes          │ No → Done (target safe)
   ▼              │
   Is fragnesia.c present?
   ┌──────┴───────┐
   │ Yes          │ No → instructions, done
   ▼              │
   User confirmation [y/N]
   ┌──────┴───────┐
   │ Yes          │ No → aborted, done
   ▼              │
   gcc -O2 -w fragnesia.c -o exp
   │
   ▼
   ./exp   ← run exploit

---

⚙️ System Requirements

Operator (host where the script is run):

• Linux (bash) — tested on Kali / Ubuntu / Debian
• gcc for compiling the exploit
• Shell access (local/SSH) to the target

Target (to be potentially vulnerable):

• Kernel affected by CVE-2026-46300 (without the skb_try_coalesce() patch)
• CONFIG_XFRM_ESPINTCP / CONFIG_INET_ESPINTCP enabled (=y/m)
• Unprivileged user namespace enabled (kernel.unprivileged_userns_clone=1)
• Local access as a non-root user (for LPE validation)

---

📥 Installation

# 1. Clone
git clone https://github.com/Kentox493/CVE-2026-46300_Fragnesia.git
cd CVE-2026-46300_Fragnesia

# 2. Make sure the script is executable
chmod +x fragnesia.sh

# 3. (Optional) Toolchain if not already available
sudo apt update && sudo apt install -y build-essential
# or (RHEL/Fedora)
sudo dnf groupinstall "Development Tools"

---

🚀 Usage

./fragnesia.sh

fragnesia.c and fragnesia.sh must be in the same directory, because the script searches for the exploit relatively.

Interactive flow

1. The script runs 3 automated audit checks.

2. If there is an indication of vulnerability (CHECKS_TRIGGERED > 0), a prompt appears:

   [?] Target detected as vulnerable (2/3). Proceed with compilation & exploit execution? [y/N]:
   

3. Type y → the script automatically compiles + runs the exploit.

4. Type anything other than y / press Enter → execution is cancelled, audit ends.

Manual bypass (without audit)

gcc -O2 -w fragnesia.c -o exp
./exp

---

🔍 Audit Check Details

Step 1 — Host & Kernel Verification

Verify hostname + running kernel, then check the distro's kernel package changelog (apt-get changelog / rpm -q --changelog) for the presence of the CVE-2026-46300 patch.

Result	Meaning
VULN	No patch in the distro changelog
SAFE	CVE-2026-46300 patch detected

Step 2 — Kernel Subsystems Configuration (XFRM / ESP)

Check the ESP-in-TCP flag in /boot/config-$(uname -r) or /proc/config.gz. Fallback: detect XFRM/IPsec modules via /lib/modules/ or lsmod.

Result	Meaning
VULN	CONFIG_XFRM_ESPINTCP / CONFIG_INET_ESPINTCP enabled (=y/m)
SAFE	Subsystem disabled / not built

Step 3 — User Namespace Isolation Prerequisite

Check kernel.unprivileged_userns_clone (fallback: /proc/sys/user/max_user_namespaces).

Result	Meaning
VULN	Userns enabled → non-privileged user can get CAP_NET_ADMIN
SAFE	Userns disabled → mitigation active
UNCERTAIN	Cannot be determined → manual review required

Final Score Interpretation

Score	Verdict
3/3 VULN	🟥 CRITICAL — full attack chain satisfied
1–2/3 VULN	🟨 MEDIUM / PARTIALLY EXPOSED — partial mitigation
0/3 VULN	🟩 SECURE — patched / components disabled

---

💣 Exploit Execution Phase

This phase is only active when CHECKS_TRIGGERED > 0. What the script runs:

# 1. Verify that fragnesia.c exists
# 2. User confirmation (default: NO / N)
# 3. Compile the exploit:
gcc -O2 -w fragnesia.c -o exp

# 4. Execute:
./exp

Compilation flag notes:

• -O2 — level 2 optimization (crucial for race/timing-based exploits to be stable)
• -w — suppress warnings (exploit source code is usually full of int-conversion and similar warnings)

Script's built-in error handling:

Condition	Handling
fragnesia.c missing	Instruction message, no crash
gcc not installed	Message with toolchain install command
Compilation failed	Exploit is not executed, compiler error is displayed
Exit code of ./exp ≠ 0	Reported as a failure

---

📸 Example Output

┌──────────────────────────────────────────────────────────────────┐
│  FRAGNESIA (CVE-2026-46300) - HOST VULNERABILITY AUDIT TOOL      │
│  Linux Kernel Page-Cache / XFRM espintcp Regression Inspector    │
└──────────────────────────────────────────────────────────────────┘

┌──[STEP 1] Host & Kernel Verification
│  [i] INFO        │ Hostname      : webserver-01
│  [i] INFO        │ Active Kernel : 6.8.0-45-generic
│  [!] VULNERABLE  │ Patch Changelog -> No security patch found for CVE-2026-46300
└──

┌──[STEP 2] Kernel Subsystems Configuration (XFRM / ESP)
│  [!] VULNERABLE  │ ESP-in-TCP Flag -> CONFIG_XFRM_ESPINTCP / CONFIG_INET_ESPINTCP active (=y/m)
└──

┌──[STEP 3] User Namespace Isolation Prerequisite
│  [!] VULNERABLE  │ User Namespaces -> Enabled (Allows unprivileged user to gain CAP_NET_ADMIN)
└──

┌──────────────────────────────────────────────────────────────────┐
│                       EXECUTIVE AUDIT SUMMARY                    │
└──────────────────────────────────────────────────────────────────┘
[!] AUDIT RESULT: CRITICAL - TARGET IS HIGHLY VULNERABLE
    All attack chain prerequisites (Kernel patch, ESP subsystem, and Userns) are satisfied.

┌──────────────────────────────────────────────────────────────────┐
│           OPTIONAL: FRAGNESIA EXPLOIT EXECUTION (LPE)            │
└──────────────────────────────────────────────────────────────────┘

[i] fragnesia.c found (18,432 bytes).

[?] Target detected as vulnerable (3/3). Proceed with compilation & exploit execution? [y/N]: y