A new Linux kernel local privilege escalation flaw called Fragnesia can let unprivileged attackers gain root access, making it the third kernel bug of this kind reported in two weeks. The issue is tracked as CVE-2026-46300 with a CVSS score of 7.8 and affects the XFRM ESP-in-TCP subsystem.
KEY FACTS
- Vulnerability Fragnesia is a Linux kernel LPE bug in the XFRM ESP-in-TCP subsystem.
- Severity It is tracked as CVE-2026-46300 with a CVSS score of 7.8.
- Impact The flaw can corrupt page cache data for read-only files and lead to root access.
- Response Advisories have been issued by multiple Linux distributions and a proof-of-concept exploit has been released.
A technical analysis from Wiz said the vulnerability lets unprivileged local attackers modify read-only file contents in the kernel page cache through a deterministic corruption primitive. The report said the flaw was found by William Bowling of the V12 security team.
V12 said the bug is separate from Dirty Frag but affects the same attack surface and uses a logic flaw in the Linux XFRM ESP-in-TCP subsystem. The disclosure said it can produce arbitrary byte writes into the kernel page cache without requiring a race condition.
According to the disclosure, the exploit can immediately yield root on major distributions by corrupting the page cache for the /usr/bin/su binary. CloudLinux said customers who already applied the Dirty Frag mitigation do not need further action until patched kernels are released, while Red Hat said it is assessing whether existing mitigations also cover the new CVE.
Microsoft said a patch is available and urged users and organizations to apply it as soon as possible. It also said that if patching is not possible, the same mitigations used for Dirty Frag should be considered, including disabling esp4, esp6 and related xfrm or IPsec functionality, limiting local shell access, hardening containers and increasing monitoring for privilege escalation.
WHY IT MATTERS
The flaw affects core Linux kernel components and can lead to full system compromise from local access, which makes patching and mitigation important for servers, desktops and containerized environments. The report said no in-the-wild exploitation has been observed, but the release of a proof-of-concept raises the risk of abuse.