---
title: Potential Linux Kernel LPE via XFRM Socket Manipulation
id: cve-2026-46300-xfrm-1
status: experimental
description: Detects suspicious XFRM socket operations consistent with Fragnesia exploitation patterns. Attackers may manipulate XFRM sockets to trigger kernel page cache corruption.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.privilege_escalation
  - attack.t1068
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    CommandLine|contains:
      - 'setkey'
      - 'ip xfrm'
      - 'xfrm_state'
      - '/proc/net/xfrm_stat'
  filter_main:
    ParentImage|endswith:
      - '/usr/sbin/sshd'
      - '/usr/sbin/anacron'
      - '/usr/bin/cron'
  condition: selection and not filter_main
falsepositives:
  - Legitimate IPsec configuration by administrators
  - VPN management scripts
level: high
---
title: Linux SUID Binary Execution from Low-Privilege User Context
id: cve-2026-46300-suid-1
status: experimental
description: Detects suspicious execution of SUID binaries from non-privileged users immediately following potential LPE exploit preparation activity. This may indicate successful privilege escalation.
references:
  - https://attack.mitre.org/techniques/T1068/
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.privilege_escalation
  - attack.t1548.001
logsource:
  category: process_creation
  product: linux
detection:
  selection:
    Image|endswith:
      - '/bin/su'
      - '/usr/bin/sudo'
      - '/bin/passwd'
      - '/usr/bin/polkit'
    User|contains:
      - 'nobody'
      - 'www-data'
      - 'apache'
      - 'nginx'
      - 'mysql'
  timeframe: 30s
  condition: selection
falsepositives:
  - Legitimate administrative tasks
  - Automated service account operations
level: high
---
title: Suspicious Temporary File Creation in DevShm
id: cve-2026-46300-tmp-1
status: experimental
description: Detects creation of executable files in /dev/shm or /tmp with unusual naming patterns, commonly used by LPE exploits as staging areas for shellcode and payloads.
references:
  - https://attack.mitre.org/techniques T1059.004
author: Security Arsenal
date: 2026/05/16
tags:
  - attack.defense_evasion
  - attack.t1070.004
logsource:
  category: file_event
  product: linux
detection:
  selection:
    TargetFilename|startswith:
      - '/dev/shm/'
      - '/tmp/'
    TargetFilename|contains:
      - '.so'
      - 'payload'
      - 'exploit'
      - 'shell'
  filter:
    Image|endswith:
      - '/usr/bin/gcc'
      - '/usr/bin/clang'
      - '/usr/bin/make'
  condition: selection and not filter
falsepositives:
  - Legitimate development work
  - Package installations
level: medium

// Hunt for XFRM-related system calls from non-root users
// Potential indicator of Fragnesia exploitation preparation
let XFRMSyscalls = SecurityEvent
| where EventID == 4700 or EventID == 4662
| where SubjectUserName != "root" and SubjectUserName != "SYSTEM"
| where ProcessName has "ip" or ProcessName has "setkey"
| extend syscallDetail = extract_all(@'(xfrm|state|policy|spire)', tostring(ProcessCommandLine))
| where isnotempty(syscallDetail)
| project TimeGenerated, Computer, SubjectUserName, ProcessName, ProcessCommandLine, syscallDetail;
XFRMSyscalls
| sort by TimeGenerated desc

// Correlate suspicious file activity with UID changes
// May indicate successful LPE exploitation
let SuspiciousFileActivity = Syslog
| where Facility in ("auth", "authpriv", "kern")
| where ProcessName contains "chmod" or ProcessName contains "chown"
| where SyslogMessage has "+s" or SyslogMessage has "4755"
| project TimeGenerated, Computer, ProcessName, SyslogMessage;
let UIDChanges = Syslog
| where Facility == "authpriv"
| where SyslogMessage has "new group" or SyslogMessage has "new user"
| project TimeGenerated, Computer, SyslogMessage;
SuspiciousFileActivity
| join kind=inner (UIDChanges) on Computer
| where abs(datetime_diff('second', TimeGenerated1, TimeGenerated)) < 60
| project TimeGenerated, Computer, ProcessName, SyslogMessage, SyslogMessage1
| sort by TimeGenerated desc

// Hunt for processes spawned with unexpected privilege elevation
// Leveraging CEF-formatted logs from EDR agents
DeviceProcessEvents
| where InitiatingProcessAccountName != "root" and InitiatingProcessAccountName != "SYSTEM"
| where AccountName == "root"
| where ProcessVersionInfoOriginalFileName in ("su", "sudo", "passwd")
| project Timestamp, DeviceName, InitiatingProcessAccountName, AccountName, ProcessCommandLine, InitiatingProcessCommandLine
| sort by Timestamp desc

-- Hunt for suspicious XFRM-related process activity and file modifications
-- Targeting Fragnesia LPE exploitation indicators

LET suspicious_procs = SELECT
  Pid,
  Name,
  CommandLine,
  Username,
  Exe,
  Ctime
FROM pslist()
WHERE Name =~ 'ip' 
   AND CommandLine =~ 'xfrm'
   AND Username != 'root'

LET temp_file_suspicious = SELECT
  FullPath,
  Size,
  Mode.String AS Mode,
  Mtime,
  Atime,
  Btime,
  User.Uid,
  User.Username
FROM glob(globs='/dev/shm/*, /tmp/*.so')
WHERE Mode.String =~ '.*x.*' 
   AND Size < 1048576
   AND User.Uid > 0

SELECT * FROM chain(
  query={SELECT * FROM suspicious_procs},
  query={SELECT * FROM temp_file_suspicious}
)

#!/bin/bash
# CVE-2026-46300 (Fragnesia) Vulnerability Assessment and Remediation Script
# Version: 1.0
# Author: Security Arsenal
# Date: 2026-05-16

set -e

RED='\033[0;31m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
NC='\033[0m'

log_info() {
    echo -e "${GREEN}[INFO]${NC} $1"
}

log_warn() {
    echo -e "${YELLOW}[WARN]${NC} $1"
}

log_error() {
    echo -e "${RED}[CRITICAL]${NC} $1"
}

log_info "Starting CVE-2026-46300 (Fragnesia) vulnerability assessment..."

# Detect Linux distribution
if [ -f /etc/os-release ]; then
    . /etc/os-release
    DISTRO=$ID
    DISTRO_VERSION=$VERSION_ID
    log_info "Detected distribution: $PRETTY_NAME"
else
    log_error "Cannot detect Linux distribution"
    exit 1
fi

# Get current kernel version
KERNEL_VERSION=$(uname -r)
log_info "Current kernel version: $KERNEL_VERSION"

# Check if kernel supports XFRM (vulnerable subsystem)
if [ -d /proc/net/xfrm ]; then
    log_warn "XFRM subsystem is enabled - this system may be vulnerable"
    XFRM_ENABLED=1
else
    log_info "XFRM subsystem not enabled"
    XFRM_ENABLED=0
fi

# Vulnerable kernel versions (update per vendor advisory)
VULNERABLE_PATTERNS="
^5\.10\.
^5\.15\.
^6\.1\.
^6\.5\.
^6\.6\.
^6\.8\.
"

is_vulnerable() {
    local version=$1
    for pattern in $VULNERABLE_PATTERNS; do
        if echo "$version" | grep -qE "$pattern"; then
            return 0
        fi
    done
    return 1
}

if [ $XFRM_ENABLED -eq 1 ] && is_vulnerable "$KERNEL_VERSION"; then
    log_error "SYSTEM APPEARS VULNERABLE to CVE-2026-46300"
    log_error "Kernel $KERNEL_VERSION is in the affected range"
    
    echo ""
    log_info "Checking for available kernel updates..."
    
    case $DISTRO in
        ubuntu|debian)
            apt-get update -qq > /dev/null 2>&1
            LATEST_KERNEL=$(apt-cache search linux-image | grep -E "linux-image-[0-9]" | sort -V | tail -n1 | awk '{print $1}')
            if [ -n "$LATEST_KERNEL" ]; then
                log_info "Latest available kernel: $LATEST_KERNEL"
            fi
            ;;
        rhel|centos|oracle)
            yum check-update kernel --quiet 2>&1 || true
            ;;
        fedora)
            dnf check-update kernel --quiet 2>&1 || true
            ;;
        alpine)
            apk update -qq > /dev/null 2>&1
            ;;
        sles|opensuse-leap)
            zypper list-updates kernel 2>&1 || true
            ;;
    esac
    
    echo ""
    log_info "Recommended Actions:"
    log_info "1. Update to the latest patched kernel for your distribution"
    log_info "2. Reboot the system to load the new kernel"
    log_info "3. Verify kernel version post-reboot"
    log_info "4. Review audit logs for signs of exploitation"
    
    echo ""
    read -p "Apply available kernel updates now? (y/n): " -n 1 -r
    echo
    if [[ $REPLY =~ ^[Yy]$ ]]; then
        log_info "Applying kernel updates..."
        case $DISTRO in
            ubuntu|debian)
                DEBIAN_FRONTEND=noninteractive apt-get install -y linux-image-generic
                ;;
            rhel|centos|oracle|fedora)
                yum install -y kernel || dnf install -y kernel
                ;;
            alpine)
                apk add --upgrade linux-lts
                ;;
            sles|opensuse-leap)
                zypper install -y kernel-default
                ;;
        esac
        log_info "Kernel update complete. SYSTEM REBOOT REQUIRED."
    else
        log_warn "Updates not applied. Schedule a reboot at your earliest convenience."
    fi
else
    log_info "System appears NOT vulnerable or XFRM is disabled"
fi

# Check for signs of potential exploitation
log_info "Checking for potential exploitation indicators..."

# Check for suspicious processes
if ps aux | grep -v grep | grep -E 'ip.*xfrm|setkey' | grep -v root > /dev/null 2>&1; then
    log_warn "Found non-root users executing XFRM-related commands"
    ps aux | grep -v grep | grep -E 'ip.*xfrm|setkey' | grep -v root || true
fi

# Check for suspicious files in /dev/shm
if find /dev/shm -type f -perm -111 2>/dev/null | head -5 | grep -q .; then
    log_warn "Found executable files in /dev/shm (potential exploit staging)"
    find /dev/shm -type f -perm -111 2>/dev/null | head -5 || true
fi

echo ""
log_info "Assessment complete. Review output above for actionable items."
log_info "For additional guidance, consult your distribution's security advisory."


---

   grep "CONFIG_XFRM" /boot/config-$(uname -r)