Loading story…
Researchers disclosed Fragnesia (CVE-2026-46300), a Linux kernel local privilege escalation flaw that allows an unprivileged local user to gain root by corrupting the kernel page cache for read-only files. The bug, discovered by William Bowling of Zellic and the V12 team, is described as a new variant in the Dirty Frag family and affects Linux kernels released before May 13, 2026. It stems from faulty bookkeeping when shared page fragments are merged in socket buffers and can be triggered through the kernel's XFRM ESP-in-TCP path, with additional exposure through rxrpc on some systems. A public proof-of-concept exploit modifies the in-memory copy of files such as /usr/bin/su to spawn a root shell while leaving the on-disk binary unchanged, reducing forensic visibility.
Vendors and distributions moved quickly to publish advisories, patches, and mitigations as exploit code became public. AlmaLinux said releases 8, 9, and 10 are affected through esp4 and esp6, with AlmaLinux 9 and 10 also exposed through rxrpc when kernel-modules-partner is installed, and released backported fixes ahead of upstream vendor updates. Recommended mitigations include disabling or blacklisting the esp4, esp6, and rxrpc kernel modules, restricting unprivileged user namespaces, and monitoring for suspicious namespace creation or XFRM manipulation; AlmaLinux also advised dropping page cache if compromise is suspected. The disclosure comes amid heightened concern over Linux local-root bugs in the same code area, and one cybercrime forum post reportedly advertised a Linux LPE zero-day for sale for $170,000.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
12 events from the most recent confirmed update back to the earliest known activity.
Fixes for CVE-2026-46300 were propagated to multiple Linux stable branches by preserving the SKBFL_SHARED_FRAG marker during fragment transfer in skb_try_coalesce(). ENISA's EUVD entry published on May 23 also linked kernel.org stable commits and numerous SUSE advisories documenting the remediation.
Gentoo published an advisory on Copy Fail, Dirty Frag, and Fragnesia, stating that although upstream kernel releases were still vulnerable to Fragnesia, all supported Gentoo kernels already included the latest Fragnesia v5 patch. The distribution recommended using security-supported Gentoo kernel packages and automating kernel upgrades instead of relying on vulnerable vanilla kernel packages.
V12 published details of a Fragnesia-related Linux kernel variant that bypasses the CVE-2026-46300 fix through an unpatched skb_segment() path, enabling the same deterministic page-cache write primitive and local root escalation. The disclosure said the issue had been reported, but as of 2026-05-15 no merged patch fixed the root cause, though a pending netdev change might partially reduce exposure.
ThreatMon reported that a threat actor using the name berz0k was advertising a Linux local privilege escalation zero-day for sale on cybercrime forums for $170,000. The seller claimed the exploit worked across major Linux distributions, though no direct link to Fragnesia was confirmed.
Following disclosure, multiple Linux distributions issued advisories, and vendors including Microsoft and Red Hat recommended patching or applying mitigations such as disabling esp4, esp6, rxrpc, or related XFRM/IPsec functionality. Some distributions were also reported to have issued backported patches.
Researchers publicly disclosed Fragnesia as a new Dirty Frag-family Linux kernel local privilege escalation vulnerability tracked as CVE-2026-46300. Reports said it affects all Linux kernels released before May 13, 2026 and allows deterministic page-cache corruption leading to root access.
A candidate upstream patch for Fragnesia was submitted to the Linux netdev mailing list. This marked the start of the coordinated upstream remediation effort for kernels released before May 13, 2026.
AlmaLinux announced that AlmaLinux 8, 9, and 10 were affected and, because Red Hat patches were not yet available, backported the upstream fix and released patched kernels to its testing repository. It also published mitigations including blacklisting esp4, esp6, and rxrpc modules.
A working proof-of-concept exploit for CVE-2026-46300 was published on May 13, 2026. The exploit demonstrated modifying the in-memory copy of a read-only file such as /usr/bin/su to spawn a root shell without changing the on-disk file.
William Bowling of the V12 security team discovered Fragnesia, a Linux local privilege escalation flaw later assigned CVE-2026-46300. The bug affects kernel socket-buffer handling in ESP/IPsec and related code paths, enabling page-cache corruption and root escalation by a local unprivileged user.
An oss-sec discussion said commit f4c50a4034e6, introduced as a fix for CVE-2026-43284, accidentally activated the vulnerable code path later dubbed Fragnesia or "copyfail 3.0." The post estimated the exposure window at about nine days until upstream correction and noted exploitation generally requires user-namespace creation unless chained with another flaw.
Sam James posted an oss-security message disclosing the Linux local privilege escalation flaw later tracked as CVE-2026-46300, describing it as a new Dirty Frag-class bug in the XFRM ESP-in-TCP path. The post included exploit details and noted that a fix had been posted to netdev but had not yet landed in netdev, Linus's tree, or stable kernels.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
27 references tracked. Mallory keeps watching after this page renders.
euvd.enisa.europa.eu
Open sourcegentoo.org
Open sourcescworld.com
Open sourcethecyberexpress.com
Open sourceseclists.org
Open sourcelwn.net
Open sourcedeb.freexian.com
Open sourcesecurity-tracker.debian.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers publicly disclosed **Dirty Frag**, a Linux kernel local privilege escalation chain that can give an unprivileged local user immediate root access across major distributions. The disclosure said the issue combines flaws in the in-place decryption fast paths for **`esp4`**, **`esp6`**, and **`rxrpc`**, allowing page-cache corruption or plaintext exposure in externally backed paged fragments. Public write-ups and exploit repositories described two working paths: overwriting **`/usr/bin/su`** with a root shell via the ESP/XFRM stack, or corrupting **`/etc/passwd`** through RXRPC/RXKAD behavior so a UID 0 account can be used without a password. The bug was published without patches or CVE assignments after an embargo was reportedly broken, and exploit code was quickly made public through oss-sec, GitHub, and security forums. A related GitHub proof of concept, **Copy Fail 2: Electric Boogaloo**, tied the ESP path to the **`MSG_SPLICE_PAGES`** no-copy-on-write fast path and reported successful exploitation on Debian, Arch, Fedora, and newer Ubuntu releases, while noting older Ubuntu 22.04 kernels were not affected by that specific path. AlmaLinux said all supported releases were affected, issued patched kernels in testing by backporting the upstream ESP fix, and recommended temporary mitigations including blacklisting or unloading **`esp4`**, **`esp6`**, and **`rxrpc`** modules and dropping page cache if compromise is suspected.
Jun 29, 2026
Two newly disclosed Linux kernel local privilege escalation flaws are enabling attackers to gain root by corrupting file-backed page-cache memory without changing files on disk. **DirtyClone** (`CVE-2026-43503`) affects the XFRM/IPsec path and abuses cloned packets after a shared-fragment safety flag is dropped during internal copying, while **pedit COW** (`CVE-2026-46331`) affects the traffic-control `act_pedit` subsystem through an out-of-bounds write. Public exploit material shows both bugs can poison the in-memory copy of privileged binaries such as `/usr/bin/su` or `/bin/su`, then execute them to obtain root access while evading file-integrity checks and, in DirtyClone’s case, potentially leaving no on-disk changes or kernel audit evidence. Exploitation in both cases depends on local access plus `CAP_NET_ADMIN`, which researchers say can often be obtained through unprivileged user namespaces on distributions such as Debian, Fedora, and RHEL by default. Reported testing showed successful exploitation on Debian 13 and RHEL 10, with Ubuntu 24.04 requiring an AppArmor-permitted path and Ubuntu 26.04 blocking some default routes despite vulnerable kernels. Upstream fixes have already landed in the Linux 7.1 release candidates, and vendors including Ubuntu, Debian, SUSE, and Red Hat have issued advisories or patches; defenders are being urged to deploy patched kernels, reboot affected systems, and consider disabling unprivileged user namespaces or blocking `act_pedit` where immediate patching is not possible.
Jul 3, 2026
Researchers disclosed **CVE-2026-31431**, dubbed **CopyFail**, a Linux local privilege escalation flaw in the kernel crypto subsystem's `algif_aead`/`AF_ALG` AEAD path that lets a low-privileged local user corrupt the page cache of readable files and gain root. The bug traces to a 2017 in-place AEAD optimization introduced in Linux 4.14 by commit `72548b093ee3`, which allowed splice-backed file pages to be reused as writable crypto buffers; attackers can then achieve a controlled write into the cached copy of targets such as setuid binaries while leaving the on-disk file unchanged. Researchers published a compact Python proof of concept said to work reliably across major distributions including Ubuntu, RHEL, SUSE, Amazon Linux, Debian, Fedora, and Arch, and warned the shared page cache also makes the flaw relevant for container escapes, CI runners, and multi-tenant cloud hosts. Upstream fixed the issue by reverting `algif_aead` to out-of-place operation in Linux **7.0**, **6.19.12**, and **6.18.22**, while older long-term branches initially lagged because the patch did not apply cleanly and required backports or workaround patches. Major vendors and downstream projects began shipping advisories and kernel updates, and temporary mitigations included disabling or blacklisting `algif_aead`, blocking `AF_ALG` socket creation with seccomp or eBPF, or using the kernel boot parameter `initcall_blacklist=algif_aead_init` where the feature was built in. After public exploit code spread and additional exploit ports appeared, **CISA added the flaw to its Known Exploited Vulnerabilities catalog**, and defenders published detections focused on suspicious `AF_ALG`, `splice()`, and setuid execution activity because traditional file-integrity checks may miss the in-memory-only tampering.
Jun 30, 2026