Linux Kernel Fragnesia Flaw Enables Local Root Escalation; Public PoC Available

Security agencies have issued advisories for Fragnesia (CVE-2026-46300), a high-severity Linux kernel vulnerability that can allow an unprivileged local attacker to obtain root privileges. Rated CVSS 7.8, the flaw affects network-buffer fragment coalescing in the IPsec-related XFRM ESP-in-TCP subsystem: the coalescing function fails to preserve a shared-fragment marker under certain conditions, allowing modification of file-backed kernel page-cache data. An upstream patch addresses preservation of that marker. Italy’s CSIRT reports that a public proof of concept is available; the supplied advisories do not report active exploitation.

Affected products include versions of RHEL, AlmaLinux, Debian, and Red Hat OpenShift Container Platform. Administrators should prioritize vendor-provided kernel updates and consult distribution advisories for affected packages and backported fixes. KISA lists fixed kernel releases 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, and 7.0.10, recommending the applicable fixed release or later. Where patches are unavailable, blocking and unloading the relevant kernel modules may temporarily reduce exposure, but can disrupt services, may fail while modules are in use, and does not remediate an existing compromise.