Security researchers have disclosed a newly identified local privilege escalation vulnerability in the Linux Kernel, dubbed “Fragnesia,” which belongs to the broader Dirty Frag family of flaws. The issue, officially tracked as CVE-2026-46300, affects the Linux Kernel’s XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to escalate privileges to root by corrupting page-cache memory.
The discovery of Fragnesia highlights how fixes for previous Linux Kernel vulnerabilities can unintentionally introduce new attack surfaces. According to researcher Hyunwoo Kim, who previously identified Dirty Frag, Fragnesia emerged as an unintended consequence of patches created to mitigate the original Dirty Frag vulnerabilities.
The vulnerability impacts a wide range of Linux distributions, many of which have already begun rolling out security updates. While a proof-of-concept exploit for Fragnesia is publicly available, researchers have stated that there is currently no confirmed evidence of active exploitation in real-world attacks.
How Fragnesia Targets the Linux Kernel
Fragnesia exploits a logic flaw within the Linux Kernel’s XFRM ESP-in-TCP implementation. Specifically, the vulnerability stems from improper handling of shared page fragments during socket buffer (skb) coalescing operations.
The attack abuses a condition where file-backed pages are inserted into a TCP receive queue before the socket transitions into ESP-in-TCP ultra-light protocol (ULP) mode. Once ESP processing is activated, the kernel decrypts queued data in-place. This process creates controlled corruption within the underlying page cache through manipulation of the AES-GCM keystream.
Researchers explained that the exploit leverages user and network namespaces to gain CAP_NET_ADMIN privileges inside an isolated namespace. Attackers can then install a specially crafted ESP security association using NETLINK_XFRM and repeatedly trigger controlled single-byte writes into cached file pages.
Using this approach, researchers successfully demonstrated overwriting the opening bytes of /usr/bin/su with a compact ELF payload. The payload executes setresuid(0,0,0) before launching /bin/sh, ultimately providing attackers with a root shell.
Importantly, the modified data exists only within page-cache memory and does not permanently alter the binary stored on disk. However, researchers warned that exploitation is not limited to /usr/bin/su. Any file readable by the user could potentially be modified, including highly sensitive files such as /etc/passwd.
Relationship Between Fragnesia and Dirty Frag
Fragnesia shares several characteristics with Dirty Frag and other recently disclosed Linux Kernel privilege escalation flaws, including Copy Fail. All of these vulnerabilities rely on corruption primitives that enable attackers to tamper with protected memory structures.
Microsoft’s threat intelligence team noted the similarities between Fragnesia and Dirty Frag in its analysis of the vulnerability.
“Similar to Dirty Frag, Fragnesia exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel,” Microsoft stated.
The company further explained:
“The primitive is then used to corrupt the page cache memory of the /usr/bin/su binary, which in turn leads to launching a shell with root privilege. Note that exploitation is not constrained to use the /usr/bin/su binary; it can modify any file readable by the user, including /etc/passwd.”
Microsoft also warned that Copy Fail has already been exploited in the wild. Shortly after Dirty Frag was disclosed, the company indicated that it may also have been leveraged in malicious attacks.
On May 8, Microsoft reported that telemetry from its Defender platform had identified limited activity that could indicate attempted exploitation involving either Dirty Frag or Copy Fail. At the time of publication, however, there were no additional public reports confirming exploitation of Dirty Frag or Fragnesia in active campaigns.
Why XFRM ESP-in-TCP Matters
The XFRM ESP-in-TCP subsystem plays a key role in enabling Encapsulating Security Payload (ESP) traffic over TCP connections within the Linux Kernel. Because ESP-in-TCP is used in certain VPN and encrypted networking scenarios, vulnerabilities affecting this component can expose critical systems to local privilege escalation attacks.
Fragnesia demonstrates how flaws in low-level networking components can lead to deterministic page-cache corruption, giving attackers powerful primitives capable of bypassing standard file protections.
Unlike some earlier Linux Kernel privilege escalation flaws, Fragnesia does not require host-level privileges before exploitation. This significantly lowers the barrier for local attackers operating within constrained environments.
Researchers also pointed out that AppArmor restrictions on unprivileged user namespaces, which are enabled by default on Ubuntu systems, may provide partial mitigation. However, additional bypasses could still allow successful exploitation under certain conditions.
Mitigation and Security Recommendations
Security experts strongly recommend that organizations apply vendor-provided Linux Kernel patches addressing Fragnesia and the underlying XFRM ESP-in-TCP vulnerability as soon as updates become available.
Until patches are fully deployed, administrators are advised to disable vulnerable modules associated with both Fragnesia and Dirty Frag if they are not required. Recommended commands include:
rmmod esp4 esp6 rxrpc
Administrators can also prevent the modules from loading by creating the following configuration:
printf ‘install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n’ > /etc/modprobe.d/fragnesia.conf
Researchers additionally recommend restricting or disabling unprivileged user namespaces wherever operationally feasible. Monitoring systems for suspicious namespace creation, abnormal AF_ALG usage, or unauthorized XFRM manipulation may also help detect exploitation attempts.
If compromise is suspected, administrators should reboot affected systems or clear page-cache contents to remove modified in-memory binaries:
echo 1 | tee /proc/sys/vm/drop_caches
As Linux Kernel developers continue addressing Dirty Frag-related vulnerabilities, Fragnesia serves as another example of how security patches can unintentionally introduce new weaknesses into complex subsystems such as XFRM ESP-in-TCP.
