Recently, details emerged regarding a new variant of a Linux Local Privilege Escalation (LPE) vulnerability. Dubbed the **Fragnesia Linux Kernel LPE Vulnerability**, this flaw allows a local attacker to obtain root access. It marks the third kernel bug identified within a two-week window.

Tracked as **CVE-2026-46300** with a CVSS score of 7.8, Fragnesia was discovered by William Bowling of the V12 security team. It originates in the Linux kernel's XFRM ESP-in-TCP subsystem.

## What is Fragnesia?

Fragnesia enables an unprivileged local attacker to modify the contents of read-only files within the kernel page cache. This paves the way for root privileges via a deterministic page-cache corruption primitive. Wiz, the Google-owned security firm, has also confirmed this behavior.

V12 clarifies that this is a distinct bug from Dirty Frag, although both reside in the same attack surface: ESP/XFRM. Fragnesia exploits a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes to the kernel page cache from read-only files. Crucially, **exploitation requires no race condition whatsoever.**

The vulnerability bears a resemblance to Copy Fail 2 (also known as CVE-2026-46252). Both grant immediate root access on all major distributions by achieving a kernel memory write primitive and subsequently corrupting the page cache memory of the `/usr/bin/su` binary. The V12 team has already released a Proof-of-Concept (PoC) exploit for Fragnesia.

Here is a technical breakdown of Fragnesia:

| Technical Detail | Fragnesia (CVE-2026-46300) |
|---|---|
| Vulnerability Type | Local Privilege Escalation (LPE) |
| Affected Component | Linux kernel's XFRM ESP-in-TCP subsystem |
| Discoverer | William Bowling (V12 security team) |
| CVSS Score | 7.8 |
| Primary Mechanism | Modification of read-only file contents in kernel page cache, corruption of `/usr/bin/su` page cache |
| Prerequisites | No race condition required |
| Attacker Access | Unprivileged local attacker |
| Similar To | Dirty Frag, Copy Fail 2 (CVE-2026-46252) |
| Exploit Availability | Proof-of-Concept (PoC) released |

## Mitigation Steps to Take Immediately

Several Linux distributions have released advisories regarding this vulnerability. Microsoft is urging users and organizations to apply patches immediately by running their update tools. If patching isn't immediately feasible, you can consider applying the same mitigations used for Dirty Frag.

Here are the recommended mitigation strategies:

| Mitigation Action | Description |
|---|---|
| Patch Application | Immediately update your Linux kernel to a patched version. |
| Dirty Frag Mitigation | Disable `esp4`, `esp6`, and related xfrm/IPsec functionality. |
| Access Restriction | Limit unnecessary local shell access for users. |
| Container Hardening | Harden container workloads to reduce the attack surface. |
| Monitoring | Enhance monitoring for anomalous privilege escalation activity. |
| AppArmor (Partial) | AppArmor restrictions on unprivileged user namespaces can serve as a partial mitigation, though bypasses may be possible. |

CloudLinux states that customers who have already applied Dirty Frag mitigations require no further action until an updated kernel is released. Red Hat is currently assessing whether existing mitigations apply to CVE-2026-46300. It is critical to remember that, unlike Dirty Frag, **Fragnesia does not require host-level privileges.**

While no active exploitation in the wild has been observed at this time, proactive measures are essential.

## The Broader LPE Threat Landscape

This development arrives amid reports that a threat actor known as "berz0k" is advertising a Linux zero-day LPE exploit on a cybercrime forum for $170,000. The actor claims the exploit works across major Linux distributions. ThreatMon reports that berz0k claims the vulnerability is TOCTOU (Time-of-Check Time-of-Use) based, capable of stable local privilege escalation without system crashes, and leverages a shared object (.so) payload dropped in `/tmp`.

This underscores that Linux LPE vulnerabilities remain a high-value target for cybercriminals, highlighting the need for continuous vigilance and sustained system patching.

## References
https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html?m=1

Fragnesia (CVE-2026-46300) is a critical Linux kernel LPE vulnerability in the XFRM ESP-in-TCP subsystem. It allows unprivileged local attackers to corrupt the page cache and gain root access—no race condition required. Here are the technical details and mitigation steps.

Unmasking Fragnesia: The New Linux Kernel LPE Flaw Handing Attackers Root Access

Reggi

Eliminate context switching and manage custom domain email directly inside Gmail. Configure unified inbound ingestion and Send As permissions seamlessly.

The Unified Inbox Architecture: Routing Custom Domain Webmail Through Gmail

Eliminate manual rotation bottlenecks, thermal lag, and biological variance by building an automated, headless AC-powered egg incubator setup.

Stop Acting as a Manual Cron Job: Engineering an Automated AC-Powered Incubator

Ditch mains AC for a stable, low-voltage DC egg incubator. Learn how dedicated temp and humidity control modules optimize poultry yields.

Why AC Mains Are Ruining Your Hatch Rates: Building a Reliable Low-Voltage DC Incubator

A technical systems breakdown of battery-powered ride-on car assembly for ages 2 to 7 (50kg max), covering safety envelopes, parental remote control, and multimedia architecture.

Architecting the Scaled EV: Remote Override Logic and Multimedia Integration for Electric Ride-On Chassis

Learn how to build a reliable smart power strip using NodeMCU and Blynk for wireless and voice-controlled electrical management.

Why Remote Power Switching Fails in Hardware Prototypes and How NodeMCU with Blynk Solves It

Fix persistent macOS bugs, wipe disk bloat, or prep for resale. Master Internet Recovery (Command+Option+R), APFS reformatting, and clean installation.

#linux-kernel

Getting Lastest Post..

Trending This Month