🔴 Fragnesia — CVE-2026-46300

Privilege escalation in the Linux kernel · CVSS 7.8 · Disclosed on May 14, 2026

Awareness repository only. This repository does not contain exploit code. Its purpose is to inform system administrators, engineers, and security teams about the nature of the vulnerability and available remediation measures.

📋 Summary

🧬 Context and genealogy

Fragnesia is the third vulnerability in a series discovered in the Linux kernel's IPsec subsystem over two weeks:

Dirty Frag (CVE-2026-43284)  ──►  Copy Fail (CVE-2026-43500)  ──►  Fragnesia (CVE-2026-46300)
         May 2026                        May 2026                        14 May 2026

Ironically, the Dirty Frag patch latently activated the Fragnesia flaw — the fix for CVE-2026-43284 introduced a code path exposing a pre-existing bug from a commit dating back to 2013.

"Fragnesia was accidentally activated by the patch fixing CVE-2026-43284."
— Hyunwoo Kim, discoverer of Dirty Frag

🔬 Technical analysis

Origin of the bug

The flaw resides in the skb_try_coalesce() function of the kernel's socket-buffer code. When coalescing fragments between buffers, the SKBFL_SHARED_FRAG marker was not propagated, causing the kernel to lose track of the fact that a fragment was backed by page cache pages (e.g., a file mapped into memory via splice()).

Exploitation chain

1. The attacker opens a TCP socket  
2. They splice() pages from a read-only file (e.g., /usr/bin/su) into the receive queue  
3. The socket switches to espintcp mode (ULP)  
4. The kernel treats the file pages as encrypted ESP text  
5. The in-place AES-GCM decryption writes controlled bytes into the page cache  
6. /usr/bin/su in memory is corrupted → root code execution on next invocation

Notable characteristics

• ✅ No race condition — 100% deterministic exploitation
• ✅ No disk modification — only the in-memory copy is altered (a reboot restores the state)
• ✅ Uses user namespaces (enabled by default) to obtain CAP_NET_ADMIN without elevated rights
• ✅ Any file readable by the attacker can be targeted, not just su
• ⚠️ Difficult to detect by traditional disk-based tools

🎯 Affected systems

All Linux kernels released before May 13, 2026 including the SKBFL_SHARED_FRAG mechanism.

Affected distributions include:

High-risk environments

• 🏢 Multi-user servers and jump servers
• ☸️ Kubernetes worker nodes
• 🏗️ CI/CD farms and shared build runners
• ☁️ Cloud SaaS platforms executing user code
• 🐳 Container clusters (shared page cache on host)

🛡️ Remediation

1. Patch — Definitive solution

Update to a patched kernel:

# Debian / Ubuntu
sudo apt-get update && sudo apt-get dist-upgrade -y
sudo reboot
uname -r  # Vérifier la version du nouveau noyau

# RHEL / AlmaLinux / Rocky Linux
sudo dnf clean metadata && sudo dnf upgrade -y
sudo reboot

# Arch Linux
sudo pacman -Syu
sudo reboot

2. Temporary mitigation — Disabling vulnerable modules

If an immediate update is not possible:

# Décharger les modules actifs
sudo rmmod esp4 esp6 rxrpc 2>/dev/null; true

# Blacklister définitivement les modules
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' \
  | sudo tee /etc/modprobe.d/fragnesia.conf

# Régénérer initramfs (Debian/Ubuntu)
sudo update-initramfs -u

⚠️ The same module blacklist as used for Dirty Frag also covers Fragnesia.

3. Verify system exposure

# Vérifier si les modules vulnérables sont chargés
lsmod | grep -E '^esp4|^esp6|^rxrpc'
# Si la commande retourne du contenu → le système est exposé

# Vérifier la version du noyau actuel
uname -r
cat /etc/os-release

4. Complementary measures (container / cloud environments)

• Block AF_ALG socket creation via Seccomp
• Block unprivileged user namespace creation
• Monitor abnormal access to /etc/passwd, /etc/sudoers, /etc/shadow, /usr/bin/su
• Restrict the splice, add_key, and unshare system calls for unprivileged users

5. Post-exploitation — Page cache flush

If exploitation is suspected before applying the patch:

sync; echo 3 | sudo tee /proc/sys/vm/drop_caches

⚠️ This only flushes the in-memory copy. If an attacker has already gained root access and installed a backdoor, this command is not sufficient — treat the system as fully compromised.

🔍 Detection

Indicators of Compromise (IoC)

Detection tools should monitor:

• Abnormal access or modification of /usr/bin/su, /usr/bin/sudo, /bin/bash in memory
• Unusual system calls: splice(), add_key(), unshare() by unprivileged users
• Creation of network user namespaces on systems where it is not expected
• espintcp network activity on unprivileged user sockets

🔎 Security tools based solely on disk file analysis cannot detect this exploitation, because the binary on disk remains intact.

📚 Official references

• 🔗 Red Hat Advisory — CVE-2026-46300
• 🔗 Patch upstream netdev
• 🔗 AlmaLinux Blog — Fragnesia
• 🔗 Tenable FAQ — CVE-2026-46300
• 🔗 TuxCare — Technical analysis
• 🔗 Help Net Security — Disclosure
• 🔗 NSFOCUS CERT Advisory
• 🔗 LinuxSecurity.com
• 🔗 SOC Prime Blog

⚖️ Legal & ethical disclaimer

This repository is published for exclusively educational and defensive purposes. It contains no exploit code (PoC).

Any use of the information in this repository for malicious purposes or without explicit authorization on third-party systems is illegal and unethical. The author disclaims any responsibility for misuse of this information.

Responsible Disclosure — If you discover a vulnerability, follow responsible disclosure practices and contact the relevant security teams before any publication.

👤 Author

Maxime288 — github.com/Maxime288

Security monitoring repository — Tracking critical Linux vulnerabilities