Recently, details emerged regarding a new variant of a Linux Local Privilege Escalation (LPE) vulnerability. Dubbed the Fragnesia Linux Kernel LPE Vulnerability, this flaw allows a local attacker to obtain root access. It marks the third kernel bug identified within a two-week window.
Tracked as CVE-2026-46300 with a CVSS score of 7.8, Fragnesia was discovered by William Bowling of the V12 security team. It originates in the Linux kernel's XFRM ESP-in-TCP subsystem.
What is Fragnesia?
Fragnesia enables an unprivileged local attacker to modify the contents of read-only files within the kernel page cache. This paves the way for root privileges via a deterministic page-cache corruption primitive. Wiz, the Google-owned security firm, has also confirmed this behavior.
V12 clarifies that this is a distinct bug from Dirty Frag, although both reside in the same attack surface: ESP/XFRM. Fragnesia exploits a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes to the kernel page cache from read-only files. Crucially, exploitation requires no race condition whatsoever.
The vulnerability bears a resemblance to Copy Fail 2 (also known as CVE-2026-46252). Both grant immediate root access on all major distributions by achieving a kernel memory write primitive and subsequently corrupting the page cache memory of the /usr/bin/su binary. The V12 team has already released a Proof-of-Concept (PoC) exploit for Fragnesia.
Here is a technical breakdown of Fragnesia:
| Technical Detail | Fragnesia (CVE-2026-46300) |
|---|---|
| Vulnerability Type | Local Privilege Escalation (LPE) |
| Affected Component | Linux kernel's XFRM ESP-in-TCP subsystem |
| Discoverer | William Bowling (V12 security team) |
| CVSS Score | 7.8 |
| Primary Mechanism | Modification of read-only file contents in kernel page cache, corruption of /usr/bin/su page cache |
| Prerequisites | No race condition required |
| Attacker Access | Unprivileged local attacker |
| Similar To | Dirty Frag, Copy Fail 2 (CVE-2026-46252) |
| Exploit Availability | Proof-of-Concept (PoC) released |
Mitigation Steps to Take Immediately
Several Linux distributions have released advisories regarding this vulnerability. Microsoft is urging users and organizations to apply patches immediately by running their update tools. If patching isn't immediately feasible, you can consider applying the same mitigations used for Dirty Frag.
Here are the recommended mitigation strategies:
| Mitigation Action | Description |
|---|---|
| Patch Application | Immediately update your Linux kernel to a patched version. |
| Dirty Frag Mitigation | Disable esp4, esp6, and related xfrm/IPsec functionality. |
| Access Restriction | Limit unnecessary local shell access for users. |
| Container Hardening | Harden container workloads to reduce the attack surface. |
| Monitoring | Enhance monitoring for anomalous privilege escalation activity. |
| AppArmor (Partial) | AppArmor restrictions on unprivileged user namespaces can serve as a partial mitigation, though bypasses may be possible. |
CloudLinux states that customers who have already applied Dirty Frag mitigations require no further action until an updated kernel is released. Red Hat is currently assessing whether existing mitigations apply to CVE-2026-46300. It is critical to remember that, unlike Dirty Frag, Fragnesia does not require host-level privileges.
While no active exploitation in the wild has been observed at this time, proactive measures are essential.
The Broader LPE Threat Landscape
This development arrives amid reports that a threat actor known as "berz0k" is advertising a Linux zero-day LPE exploit on a cybercrime forum for $170,000. The actor claims the exploit works across major Linux distributions. ThreatMon reports that berz0k claims the vulnerability is TOCTOU (Time-of-Check Time-of-Use) based, capable of stable local privilege escalation without system crashes, and leverages a shared object (.so) payload dropped in /tmp.
This underscores that Linux LPE vulnerabilities remain a high-value target for cybercriminals, highlighting the need for continuous vigilance and sustained system patching.
References
https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html?m=1