Fragnesia Linux Kernel Flaw Lets Local Users Gain Root via Page Cache Corruption

Researchers disclosed Fragnesia (CVE-2026-46300), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain root by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM ESP-in-TCP path, with additional exposure through rxrpc on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as /usr/bin/su to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility.

Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through esp4 and esp6, with AlmaLinux 9 and 10 also exposed through rxrpc when kernel-modules-partner is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the esp4, esp6, and rxrpc kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for $170,000.