CVE-2026-46300: Linux Kernel Fragnesia ESP Shared-Fragment Flaw Gives Local Root

Background

CVE-2026-46300, nicknamed “Fragnesia” by the V12 team that published a proof of concept, is a flaw in the Linux kernel’s networking buffer (skb) handling that affects the IPsec ESP code path. It belongs to the “Dirty Frag” bug class, which extends the page-cache write family that includes Dirty Pipe. Greg Kroah-Hartman assigned the CVE on the oss-security list on May 13, 2026. CISA added it to the Known Exploited Vulnerabilities (KEV) catalog on October 28, 2026 with a federal due date of October 31, 2026.

Technical Mechanism

NVD lists CWE-787 (NVD, primary), CWE-456 (CISA-ADP, secondary) and CWE-123 (Red Hat, secondary). CISA’s KEV entry lists CWE-456, missing initialization of a variable. NVD scores the flaw CVSS 3.1 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); the Linux kernel CNA and Red Hat give the same score and vector as secondary sources.

The kernel commit message describes the root cause. skb_try_coalesce() can attach paged fragments from one skb to another. If the source carries the SKBFL_SHARED_FRAG flag, the destination can end up holding externally owned or page-cache-backed fragments, but the marker is lost. ESP input checks skb_has_shared_frag() before deciding whether it can skip skb_cow_data(). With the marker missing, ESP decrypts in place over page-cache pages. The fix propagates the flag when fragments are transferred.

V12’s published description of the exploit, as quoted on oss-security, is more concrete. When a TCP socket moves to the espintcp ULP after file data has been spliced into its receive queue, the kernel treats the queued file pages as ESP ciphertext. The AES-GCM keystream byte is XORed into the cached page, and by choosing the IV nonce the attacker can set one chosen byte per trigger. V12 reports that its exploit overwrites the first 192 bytes of /usr/bin/su in the page cache with a small ELF stub that calls setresuid, setresgid and execve /bin/sh, then runs su for a root shell. The on-disk binary is untouched. This is V12’s account, and we have not reproduced it.

Real-World Exploitation Evidence

• CISA KEV: added October 28, 2026. knownRansomwareCampaignUse is “Unknown” and the entry is flagged for forensic triage. CISA’s description says the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. That chain claim comes from the CISA entry alone; we did not find a second source. Our own coverage of the two PHP flaws is in CVE-2026-109618 and CVE-2026-109619.
• CISA-ADP SSVC: the NVD and CVE.org records carry a CISA Coordinator SSVC entry of Exploitation: active, Automatable: no, Technical Impact: total. Its timestamp is 2026-05-14, which is before the CVE record was published on 2026-05-23; we cannot explain that gap. The entry gives no detail on who exploited the flaw, so we do not treat it as independent corroboration of the KEV listing.
• Public exploit code: V12 provided a proof of concept with its disclosure, attached to the oss-security thread of May 13, 2026. Separately, Hyunwoo Kim’s May 21 post lists V12’s repository PoC among four Dirty Frag variants that a different patch (48f6a535) addresses, and says the CVE-2026-46300 fix was split into its own patch.
• Attribution: no evidence found as of 2026-10-29 in the CISA KEV record, the NVD record or the oss-security posts we read of a named threat actor or campaign using this CVE.

Impact Assessment

An attacker who already has local code execution as an unprivileged user can become root. In a web-hosting setting this makes any foothold, such as a webshell running as the web server user, a full host compromise, which is the pairing CISA describes. Canonical notes that on container hosts running arbitrary third-party workloads the flaw may also facilitate container escape, though it said no container-escape proof of concept had been published when it wrote. Shared hosts, CI runners and multi-tenant Linux systems are the highest-risk environments. V12 reports that the modification lives only in the page cache and is not written back to disk.

Affected Versions

NVD’s CPE data marks these kernel ranges as vulnerable:

NVD also lists 7.1-rc1 through rc4. Distributions backport fixes, so check the vendor advisory. Canonical’s fixed packages are: Focal (20.04) 5.15.0-181.19120.04.1 (5.4 kernels not affected); Jammy 5.15.0-181.191 and 6.8 HWE 6.8.0-124.12422.04.1; Noble 6.8.0-124.124 and 6.17 HWE 6.17.0-35.35~24.04.1; 25.10 6.17.0-35.35; 26.04 7.0.0-22.22. Canonical lists Ubuntu 14.04, 16.04 and 18.04 as not affected.

Remediation Steps

1. Install your distribution’s kernel update and reboot. Ubuntu, Red Hat and Rocky Linux have published advisories; NVD references many Red Hat errata.
2. Where you cannot patch yet, apply Canonical’s interim mitigation, which disables the ESP modules:

   install esp4 /bin/false
   install esp6 /bin/false

   Unload any loaded modules afterward. Canonical’s separate Dirty Frag mitigation also blocks rxrpc, and says disabling only some of the esp4, esp6 and rxrpc modules leaves the others exploitable. Canonical says hosts that applied the Dirty Frag mitigation are not affected by Fragnesia, and the same kernel update fixes both. Kim recommends keeping mitigations in place for now because further variants are expected in the esp module (oss-security, May 21).
3. This mitigation breaks IPsec ESP, so it will affect VPNs such as StrongSwan.
4. Reboot into the patched kernel. Our assessment, untested: a reboot also clears any page-cache tampering, so on hosts suspected of compromise, inspect the cached copies of setuid binaries before rebooting or evicting caches.

Detection Guidance

No file or network IOCs have been published for this CVE. The following is our assessment.

• Alert on unexpected processes gaining uid 0 from a web-server or service account, for example php-fpm, www-data or apache parents with a su child that becomes root.
• Audit setsockopt calls that set the espintcp ULP on hosts with no IPsec role, and module loads of esp4, esp6 and rxrpc where they are blocked.
• V12 says the on-disk file is unchanged. On a suspect host, compare the cached copy of setuid binaries such as /usr/bin/su (a normal read goes through the page cache) with a known-good copy before evicting caches or rebooting, since either destroys the evidence.
• Hunt for new PHP files in web roots on any host where the PHP flaws above were exposed.

Timeline

References

• NVD: CVE-2026-46300
• oss-security: Fragnesia disclosure thread (May 13, 2026)
• oss-security: Dirty Frag variants fix (May 21, 2026)
• Canonical: Fragnesia mitigations and fixed versions
• Canonical: Dirty Frag mitigations
• Kernel fix commit
• Red Hat: CVE-2026-46300
• CISA KEV catalog entry