{"id":913,"date":"2026-05-14T08:12:04","date_gmt":"2026-05-14T08:12:04","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=913"},"modified":"2026-05-14T08:12:04","modified_gmt":"2026-05-14T08:12:04","slug":"new-fragnesia-linux-kernel-lpe-grants-root-access-via-page-cache-corruption","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=913","title":{"rendered":"New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>May 14, 2026<\/span><\/span>Vulnerability \/ Linux<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Details have emerged about a new variant of the recent Dirty Frag Linux local privilege escalation (LPE) vulnerability that allows local attackers to gain root access, making it the third such bug to be identified in the kernel within a span of two weeks.<\/p>\n

Codenamed Fragnesia<\/a><\/strong>, the security vulnerability is tracked as CVE-2026-46300 (CVSS score: 7.8) and is rooted in the Linux kernel’s XFRM ESP-in-TCP subsystem. It was discovered by researcher William Bowling of the V12 security team.<\/p>\n

\u00abThe vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache and achieve root privileges through a deterministic page-cache corruption primitive,\u00bb Google-owned Wiz said<\/a>.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Advisories have been released by multiple Linux distributions –<\/p>\n

\u00abThis is a separate bug in the ESP\/XFRM from Dirty Frag which has received its own patch,\u00bb V12 said. \u00abHowever, it is in the same surface and the mitigation is the same as for Dirty Frag. It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.\u00bb<\/p>\n

Fragnesia is similar to Copy Fail<\/a> and Dirty Frag<\/a> (aka Copy Fail 2) in that it immediately yields root on all major distributions by achieving a memory write primitive in the kernel and corrupting the page cache memory of the \/usr\/bin\/su binary. A proof-of-concept (PoC) exploit has been released by V12.<\/p>\n

\"\"<\/a><\/div>\n

\u00abCustomers who have already applied the Dirty Frag mitigation need no further action until patched kernels are released,\u00bb CloudLinux maintainers said. Red Hat said<\/a> it’s performing an assessment to confirm if existing mitigations extend to CVE-2026-46300.\u00a0<\/p>\n

Wiz also noted that AppArmor restrictions on unprivileged user namespaces may serve as a partial mitigation, requiring additional bypasses for successful exploitation. However, unlike Dirty Frag, no host-level privileges are required.\u00a0<\/p>\n

\u00abA patch is available, and while no in-the-wild exploitation has been observed at this time, we urge users and organizations to apply the patch as soon as possible by running update tools,\u00bb Microsoft said<\/a>. \u00abIf patching is not possible at this point, consider applying the same mitigations for Dirty Frag.\u00bb<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

This includes disabling esp4, esp6, and related xfrm\/IPsec functionality, restricting unnecessary local shell access, hardening containerized workloads, and increasing monitoring for abnormal privilege escalation activity.<\/p>\n

The development comes as a threat actor named \u00abberz0k\u00bb has been observed advertising on cybercrime forums a zero-day Linux LPE exploit for $170,000, claiming it works on multiple major Linux distributions.<\/p>\n

\u00abThe threat actor claims the vulnerability is TOCTOU-based (Time-of-Check Time-of-Use), capable of stable local privilege escalation without causing system crashes, and leverages a shared object (.so) payload dropped into the \/tmp directory,\u00bb ThreatMon said<\/a> in a post on X.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802May 14, 2026Vulnerability \/ Linux Details have emerged about a new variant of the recent Dirty Frag Linux local privilege escalation (LPE) vulnerability that allows local attackers to gain…<\/p>\n","protected":false},"author":1,"featured_media":914,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[130,1666,1667,1664,1567,1571,181,1574,1665,61],"class_list":["post-913","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-access","tag-cache","tag-corruption","tag-fragnesia","tag-grants","tag-kernel","tag-linux","tag-lpe","tag-page","tag-root"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/913","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=913"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/913\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/914"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=913"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=913"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=913"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}