Fragnesia (CVE-2026-46300): Dirty Frag Variant Hits XFRM – Is Your Kernel Next?
Just when we thought we were done with the "Dirty" series, here comes Fragnesia (CVE-2026-46300). It’s the third local privilege escalation (LPE) vulnerability to hit the Linux kernel in the last two weeks. This one targets the XFRM framework (used for IPsec) and involves page cache corruption to get root.
Key Details:
- CVE: CVE-2026-46300
- CVSS: 7.8 (High)
- Mechanism: Corruption in the XFRM subsystem leading to LPE.
Since this targets a specific networking feature, environments utilizing IPsec should prioritize patching. If you don't use IPsec, you might be able to unload the module, though that requires a reboot.
For detection, keep an eye on strange execve calls from low-priv users spawning root shells. A quick way to check if you're leveraging XFRM on your Linux nodes:
# Check for existing Security Associations or Policies
ip xfrm state list
If that comes back empty and you don't use VPN features, you're likely safe from the immediate exploit path, though patching is still the best move.
How is everyone handling the patch cadence for this recent wave of kernel bugs? Are you waiting for the distro backports, or just compiling upstream immediately?
From a SOC perspective, LPEs are a nightmare because they look like valid admin activity until they don't. We are tightening our auditing rules today. If you have auditd running, you should monitor for unexpected UID 0 spawns.
# Search for recent root executions
ausearch -m EXECVE -ua root -ts recent
Just make sure you filter out your known automation tools or your inbox will flood.
I've been reviewing the PoC code for this variant. It specifically relies on the XFRM interface being active. For most containerized workloads on major cloud providers, this is often enabled by default for node-to-node encryption.
If you don't need IPsec, you can try blocking the module loading, though kernel hardening is safer:
# Check if module is loaded
lsmod | grep xfrm_user
If it's not loaded, your attack surface is significantly reduced for this specific bug.
Verified Access Required
To maintain the integrity of our intelligence feeds, only verified partners and security professionals can post replies.
Request Access