![\"Fragnesia](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2026\/05\/linux-tux-650.webp\" "\\"Linux\\"\/")
<\/p>\nResearchers have found and disclosed yet another local privilege escalation (LPE) vulnerability in the Linux kernel: CVE-2026-46300, aka \u201cFragnesia\u201d.<\/p>\n
<\/p>\n
The flaw is in the same class of vulnerabilities as the recently disclosed Dirty Frag<\/a> bug(s). <\/p>\n Like Dirty Frag, it affects the same Linux module (xfrm-ESP). In fact, according to Dirty Frag discoverer Hyunwoo Kim, Fragnesia was \u201caccidentally activated\u201d by the patch fixing one of the original Dirty Frag vulnerabilities (i.e., CVE-2026-43284).<\/p>\n CVE-2026-46300 explained<\/p>\n Fragnesia was discovered by William Bowling of Zellic.io, with the help of the company\u2019s AI-agentic software auditing tool.<\/p>\n The research team published a short technical explainer<\/a> and proof-of-concept exploit code<\/a>. <\/p>\n As Wiz researchers helpfully explained<\/a>, Fragnesia allows unprivileged local attackers to modify read-only file contents in the kernel page cache, and \u201cthrough a deterministic page-cache corruption primitive,\u201d achieve root privileges. <\/p>\n Patches and mitigations for Fragnesia<\/p>\n Like Copy Fail<\/a> and Dirty Frag before it, Fragnesia is less of a risk for single-user workstations and single-tenant servers than for shared Linux hosts (where multiple users share a kernel), container clusters (where the page cache is shared across the host), CI runners and build farms, and cloud SaaS solutions running user code.<\/p>\n Linux admins should apply vendor kernel patches when they become available. In the meantime, they should disable\/denylist or unload the vulnerable modules (for both Fragnesia and DirtyFrag: esp4<\/strong>, esp6<\/strong>, rxrpc<\/strong>) to mitigate the risk of exploitation.<\/p>\n Some Linux distributions have already relased kernel patches, namely AlmaLinux<\/a> and CloudLinux<\/a>.<\/p>\n \u201cThe exploit can modify legitimate system binaries (the public PoC overwrites \/usr\/bin\/su<\/strong>) in the page cache as part of gaining root, so applying the mitigation alone is not enough on systems that may have been targeted before the mitigation was in place,\u201d the CloudLinux team explained. <\/p>\n \u201cAfter mitigating, drop the page cache to force a reload from disk [by running the following command: sudo sh -c \u201cecho 3 > \/proc\/sys\/vm\/drop_caches\u201d<\/strong>].\u201d<\/p>\n
![](\"https:\/\/www.europesays.com\/ie\/wp-content\/uploads\/2025\/09\/devider.webp.webp\"\/)
<\/p>\n