CVE-2026-46300 — disclosed with a working proof-of-concept on May 13, 2026 — affects all Linux kernels released before that date and lets unprivileged local users gain root by writing arbitrary bytes into the kernel page cache of read-only files.
How Fragnesia corrupts the page cache via ESP decryption
According to analysis published by cloud security firm Wiz, the flaw dubbed Fragnesia lives in the kernel's handling of shared page fragments when it merges socket buffers. Under a specific sequence of operations, that bookkeeping fails and the kernel loses track of which memory pages are backed by external files.
The exploit path described in the disclosure uses a TCP socket as the trigger: an attacker feeds file contents into a socket and then enables ESP-in-TCP encryption on the same socket. The kernel proceeds to decrypt the queued bytes directly over the cached file pages, and the AES-GCM keystream can produce controlled overwrites in memory. In short, decryption is applied in-place to page-cache memory that the kernel no longer correctly associates with its originating file.
Proof-of-concept and forensic stealth
William Bowling of Zellic and the V12 team published a working proof-of-concept (PoC) exploit alongside the May 13 disclosure. Bowling's PoC rewrites the opening bytes of /usr/bin/su in the kernel's in-memory copy, using that transient modification to drop to a root shell.
Because the alteration is confined to the kernel's in-memory image of the binary, the on-disk file remains untouched. The disclosure notes that this behavior “leaves no trace for standard disk forensics,” making post-incident detection and attribution based on disk artefacts unreliable.
Relationship to Dirty Frag and recent Linux kernel privilege escalations
Bowling described Fragnesia as a “separate bug in the ESP/XFRM from dirtyfrag” that inhabits the same attack surface. Hyunwoo Kim, the researcher who disclosed the earlier Dirty Frag vulnerabilities, said Fragnesia emerged as an unintended side effect of a patch written to address Dirty Frag.
The Fragnesia disclosure arrives shortly after two other local privilege escalation bugs: Copy Fail (CVE-2026-31431), disclosed April 29, and Dirty Frag (CVE-2026-43284 and CVE-2026-43500), disclosed May 7. Together they constitute three root-level Linux kernel bugs disclosed in three weeks.
Patch status, mitigations, and interim defenses
A candidate upstream fix for Fragnesia was submitted to the netdev mailing list on May 13 and had not been merged into the mainline kernel at the time of publication. Several Linux distributions, however, have begun shipping their own backported patches to protect their users before an upstream merge.
The disclosure identifies the esp4, esp6 and rxrpc kernel modules as the same modules used by Dirty Frag. Administrators who previously disabled those modules as an interim defense against Dirty Frag are also covered for Fragnesia until patched kernels are available. The disclosure also recommends restricting unprivileged user namespaces and monitoring for suspicious namespace creation or XFRM manipulation as additional interim steps.
What this means for systems administrators, distribution maintainers, and security teams
- Systems administrators: If you already disabled esp4, esp6 or rxrpc to mitigate Dirty Frag, those steps remain effective against Fragnesia until you can deploy a patched kernel. If you have not, consider the trade-offs of disabling those modules versus applying a vendor backport.
- Distribution maintainers: Several distributions have started shipping backported fixes; maintainers must decide whether to continue with distribution-level backports or wait for an upstream merge and then forward-port the change.
- Security and detection teams: Because the exploit alters only in-memory copies of binaries and leaves no on-disk evidence, teams should prioritize monitoring for suspicious XFRM manipulation and unexpected namespace creation, and prepare incident response guides that do not rely solely on disk forensics.
Fragnesia underscores how subtle interactions inside the kernel's networking and crypto stacks can yield powerful local exploits. With a published PoC and kernels affected up to May 13, 2026, the immediate questions for operators are practical: have the esp4/esp6/rxrpc modules already been disabled, have vendor backports been applied, and do detection controls include XFRM and namespace activity? The upstream patching process and the pace of distribution backports will determine how quickly the practical risk is reduced.
