Vulnerability Overview
Disclosed in mid-May 2026, Fragnesia (CVE-2026-46300) is a critical successor to the CopyFail and DirtyFrag vulnerabilities. It is a local privilege escalation (LPE) flaw that exploits the Linux kernel's socket buffer coalescing logic inside the IPsec encapsulation pathway (espintcp).
By taking advantage of incorrect memory handling when splicing data from a file onto an active ESP-in-TCP socket, an unprivileged local attacker can corrupt read-only memory pages in the kernel's Page Cache. This corruption can be used to overwrite system binaries (such as /usr/bin/su or /bin/sudo) in memory, leading to an immediate root shell takeover without triggering typical system race conditions.
Exploitation Potential: Fragnesia is highly deterministic and does not rely on race conditions. PoC exploits are highly reliable and can easily facilitate container escapes in Kubernetes configurations where host kernel access is unconfined.
Technical Details
The core of the vulnerability lies in the skb_try_coalesce() function under the networking stack, combined with espintcp mode activation on TCP sockets. When data is spliced from a read-only page (via the splice() system call) into a socket's write queue, the kernel marks these page fragments as immutable.
However, when the socket is upgraded to handle ESP-in-TCP encapsulation, the kernel processes incoming packet fragments and attempts to decrypt them in-place. If the packet structure is malformed, the coalesce handler fails to check if the destination buffers contain memory-mapped file pages from the page cache, triggering a write directly onto read-only kernel buffers.
Attack Vector
Mitigation & Remediation
Organizations running Linux-based container hosts must deploy kernel patches or implement temporary mitigations.
1. Update Linux Kernel
Apply the security updates from your OS vendor. Patches ensure that skb_try_coalesce() verifies write access flags for memory pages before executing inline decryption.
Ubuntu / Debian:
sudo apt update && sudo apt upgrade linux-image-generic
sudo reboot
RHEL / Rocky Linux:
sudo dnf update kernel -y
sudo reboot
2. Disable Vulnerable Modules (Mitigation)
If immediate patching is not possible, disable the kernel modules responsible for ESP handling:
# Block loading of ESP modules
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' | sudo tee /etc/modprobe.d/fragnesia.conf
# Unload currently loaded modules
sudo rmmod esp4 esp6 xfrm_user 2>/dev/null || true
Threat Response Advisory
Our intelligence team monitors these vulnerabilities 24/7. For real-time threat detection and custom mitigation playbooks, contact our SOC response unit.