⚠️ Ethical & Legal Warning This tool is intended solely for legitimate and authorized security testing — contracted pentests, lab/CTF environments, or your own assets. Unauthorized use on systems without the owner's permission is a criminal offense (UU ITE, Computer Fraud and Abuse Act, etc.). The user bears full responsibility.

📖 Vulnerability Summary

CVE-2026-46300 is a Local Privilege Escalation (LPE) vulnerability in the Linux kernel caused by a regression in skb_try_coalesce() that leads to page-cache corruption, exploited through the XFRM ESP-in-TCP (espintcp) subsystem.

This repository contains 2 components:

🏗 Workflow

┌───────────────────────┐
│   fragnesia.sh        │
│   Audit: 3 checks     │
└──────────┬────────────┘
           ▼
   CHECKS_TRIGGERED > 0 ?
   ┌──────┴───────┐
   │ Yes          │ No → Done (target safe)
   ▼              │
   Is fragnesia.c present?
   ┌──────┴───────┐
   │ Yes          │ No → instructions, done
   ▼              │
   User confirmation [y/N]
   ┌──────┴───────┐
   │ Yes          │ No → aborted, done
   ▼              │
   gcc -O2 -w fragnesia.c -o exp
   │
   ▼
   ./exp   ← run exploit

⚙️ System Requirements

Operator (host where the script is run):

• Linux (bash) — tested on Kali / Ubuntu / Debian
• gcc for compiling the exploit
• Shell access (local/SSH) to the target

Target (to be potentially vulnerable):

• Kernel affected by CVE-2026-46300 (without the skb_try_coalesce() patch)
• CONFIG_XFRM_ESPINTCP / CONFIG_INET_ESPINTCP enabled (=y/m)
• Unprivileged user namespace enabled (kernel.unprivileged_userns_clone=1)
• Local access as a non-root user (for LPE validation)

📥 Installation

# 1. Clone
git clone https://github.com/Kentox493/CVE-2026-46300_Fragnesia.git
cd CVE-2026-46300_Fragnesia

# 2. Make sure the script is executable
chmod +x fragnesia.sh

# 3. (Optional) Toolchain if not already available
sudo apt update && sudo apt install -y build-essential
# or (RHEL/Fedora)
sudo dnf groupinstall "Development Tools"

🚀 Usage

./fragnesia.sh

fragnesia.c and fragnesia.sh must be in the same directory, because the script searches for the exploit relatively.

Interactive flow

1. The script runs 3 automated audit checks.

2. If there is an indication of vulnerability (CHECKS_TRIGGERED > 0), a prompt appears:

   root@kitploit:~

   [?] Target detected as vulnerable (2/3). Proceed with compilation & exploit execution? [y/N]:
   

3. Type y → the script automatically compiles + runs the exploit.

4. Type anything other than y / press Enter → execution is cancelled, audit ends.

Manual bypass (without audit)

gcc -O2 -w fragnesia.c -o exp
./exp

🔍 Audit Check Details

Step 1 — Host & Kernel Verification

Verify hostname + running kernel, then check the distro's kernel package changelog (apt-get changelog / rpm -q --changelog) for the presence of the CVE-2026-46300 patch.

Step 2 — Kernel Subsystems Configuration (XFRM / ESP)

Check the ESP-in-TCP flag in /boot/config-$(uname -r) or /proc/config.gz. Fallback: detect XFRM/IPsec modules via /lib/modules/ or lsmod.

Step 3 — User Namespace Isolation Prerequisite

Check kernel.unprivileged_userns_clone (fallback: /proc/sys/user/max_user_namespaces).

Final Score Interpretation

💣 Exploit Execution Phase

This phase is only active when CHECKS_TRIGGERED > 0. What the script runs:

# 1. Verify that fragnesia.c exists
# 2. User confirmation (default: NO / N)
# 3. Compile the exploit:
gcc -O2 -w fragnesia.c -o exp

# 4. Execute:
./exp

Compilation flag notes:

• -O2 — level 2 optimization (crucial for race/timing-based exploits to be stable)
• -w — suppress warnings (exploit source code is usually full of int-conversion and similar warnings)

Script's built-in error handling:

📸 Example Output

┌──────────────────────────────────────────────────────────────────┐
│  FRAGNESIA (CVE-2026-46300) - HOST VULNERABILITY AUDIT TOOL      │
│  Linux Kernel Page-Cache / XFRM espintcp Regression Inspector    │
└──────────────────────────────────────────────────────────────────┘

┌──[STEP 1] Host & Kernel Verification
│  [i] INFO        │ Hostname      : webserver-01
│  [i] INFO        │ Active Kernel : 6.8.0-45-generic
│  [!] VULNERABLE  │ Patch Changelog -> No security patch found for CVE-2026-46300
└──

┌──[STEP 2] Kernel Subsystems Configuration (XFRM / ESP)
│  [!] VULNERABLE  │ ESP-in-TCP Flag -> CONFIG_XFRM_ESPINTCP / CONFIG_INET_ESPINTCP active (=y/m)
└──

┌──[STEP 3] User Namespace Isolation Prerequisite
│  [!] VULNERABLE  │ User Namespaces -> Enabled (Allows unprivileged user to gain CAP_NET_ADMIN)
└──

┌──────────────────────────────────────────────────────────────────┐
│                       EXECUTIVE AUDIT SUMMARY                    │
└──────────────────────────────────────────────────────────────────┘
[!] AUDIT RESULT: CRITICAL - TARGET IS HIGHLY VULNERABLE
    All attack chain prerequisites (Kernel patch, ESP subsystem, and Userns) are satisfied.

┌──────────────────────────────────────────────────────────────────┐
│           OPTIONAL: FRAGNESIA EXPLOIT EXECUTION (LPE)            │
└──────────────────────────────────────────────────────────────────┘

[i] fragnesia.c found (18,432 bytes).

[?] Target detected as vulnerable (3/3). Proceed with compilation & exploit execution? [y/N]: y

┌──[STEP 4] Compilation & Exploit Execution (fragnesia.c)
│  [i] INFO        : Toolchain: gcc (Ubuntu 13.2.0-23ubuntu4) 13.2.0
│  $ gcc -O2 -w fragnesia.c -o exp
│  [✓] Compilation succeeded -> ./exp
│  $ ./exp
│  [*] Fragnesia exploit running...
│  [*] Overwriting page cache...
│  [*] Got root! uid=0(root) gid=0(root)
└──

🛡 Remediation (for Blue Team)

1. Kernel patching — upgrade to a release that includes the skb_try_coalesce() fix from your distro vendor.
2. Disable the unprivileged user namespace (temporary):
   root@kitploit:~

   sudo sysctl -w kernel.unprivileged_userns_clone=0
   

   Persistent: add it to /etc/sysctl.conf.
3. Blacklist the ESP module if the server does not serve VPN/IPsec:
   root@kitploit:~

   echo 'install esp4_offload /bin/true' | sudo tee /etc/modprobe.d/disable-esp.conf
   sudo update-initramfs -u
   

4. Detection & hardening:
   • Monitor for odd binaries named exp / suspicious processes in /tmp
   • Restrict CAP_NET_ADMIN on containers & user namespaces
   • Use an LSM (AppArmor/SELinux) to restrict namespace creation

📁 Repository Structure

CVE-2026-46300_Fragnesia/
├── fragnesia.sh     # Audit scanner + exploit execution trigger (bash)
├── fragnesia.c      # LPE exploit source (C)
└── README.md        # This documentation

⚖️ Disclaimer & License

For authorized use only. This tool is intended for:

• Professional penetration testing (written contract)
• Security research & responsible disclosure
• Lab / CTF environment

You must have written permission from the system owner before running this tool on any infrastructure.

The repository is provided "as-is" without any warranty. Contributors are not responsible for misuse.

License: MIT

📚 References

• CVE-2026-46300 — NVD / MITRE
• Kernel skb_try_coalesce() — networking stack documentation
• CVE-2022-0185 — reference for similar page-cache LPE techniques