CVE-2026-46300Disclosure(linux / linux_kernel)

2026 Linux 重置密码教程大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)

A new variant of the recent Dirty Frag vulnerability, named Fragnesia (CVE-2026-46300), has been discovered in the Linux XFRM ESP-in-TCP subsystem. Similar to Dirty Frag, Fragnesia exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel. The primitive is then used to corrupt the page cache memory of the [/]usr[/]bin[/]su binary, which in turn leads to launching a shell with root privilege. Note that exploitation is not constrained to use the [/]usr[/]bin[/]su binary; it can modify any file readable by the user, including [/]etc[/]passwd. A patch is available, and while no in-the-wild exploitation has been observed at this time, we urge users and organizations to apply the patch as soon as possible by running update tools. If patching is not possible at this point, consider applying the same mitigations for Dirty Frag, such as: - Assess whether esp4, esp6, and related xfrm/IPsec functionality can be temporarily disabled safely - Restrict unnecessary local shell access - Harden containerized workloads - Increase monitoring for abnormal privilege escalation activity Microsoft Defender detects and blocks known Fragnesia proof-of-concept (PoC) exploit codes using existing detections for Dirty Frag, such as Trojan:Linux/DirtyFrag.DA!MTB or Trojan:Linux/DirtyFrag.Z!MTB. Microsoft continues to investigate the issue, and we'll share updates as more information becomes available.

Linux 重置密码大全 - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300) -PinTheft (CVE-2026-43494)

Them: Linux is most secure OS Me: Yes - Dirty Cow (CVE-2016-5195) - Dirty Pipe (CVE-2022-0847) - io_uring UAF (CVE-2022-2602) - Copy Fail (CVE-2026-31431) - io_uring ZCRX freelist (CVE-2026-43121) - Dirty Frag (CVE-2026-43284 CVE-2026-43500) - Fragnesia (CVE-2026-46300)

🚨 A third Linux kernel local-root flaw has been disclosed: Fragnesia. 🚨 Like Copy Fail & Dirty Frag, Fragnesia gives root on all major distributions. Every supported AlmaLinux release is affected. Help us test the patched kernels: https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/ https://t.co/g0b7Hwrcnv

記憶バッファに収まらないんですが…… ・Copy Fail / CVE-2026-31431 ・Dirty Frag / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300

🛑 3rd Linux kernel LPE in just ~2 weeks: Fragnesia (CVE-2026-46300) just dropped. Attackers can now gain root by corrupting the kernel page cache through a flaw in XFRM ESP-in-TCP. PoC is public. Major distros have already issued advisories. Details: https://thehackernews.com/2026/05/new-fragnesia-linux-kernel-lpe-grants.html

Linuxカーネルの権限昇格の脆弱性「DirtyClone」が公開され、JFrog Security Researchは6月25日に動作するエクスプロイトを公開した。CVE-2026-43503が割り当てられており、ローカルユーザーがroot権限を取得できる可能性がある。 原因は、ネットワークパケットを複製する際に、ファイルと共有されているメモリを示すフラグが失われることにある。攻撃者はIPsec経由で複製されたパケットを利用し、メモリ上に読み込まれた/usr/bin/suなどの実行ファイルを書き換え、次回実行時にroot権限を取得できる。 変更はディスク上のファイルには反映されず、カーネルのページキャッシュ内だけで発生するため、ファイル整合性チェックでは検出されず、再起動すると元に戻るという。 攻撃にはCAP_NET_ADMIN権限が必要だが、DebianやFedoraではデフォルトで有効な非特権ユーザー名前空間を利用して取得できる。一方、Ubuntu 24.04以降ではAppArmorにより標準的な攻撃手法は制限される。 DirtyCloneは、Copy Fail（CVE-2026-31431）、DirtyFrag（CVE-2026-43284、CVE-2026-43500）、Fragnesia（CVE-2026-46300）に続く4件目の関連脆弱性となる。修正は5月21日にメインラインへ取り込まれ、Linux v7.1-rc5以降および安定版・LTSへバックポートされている。更新できない場合は、非特権ユーザー名前空間を無効化するか、IPsec関連モジュールを無効化することで攻撃面を減らせるとしている。 https://thehackernews.com/2026/06/new-dirtyclone-linux-kernel-flaw-lets.html

Threat Intelligence Alert | In-Depth Technical Analysis: New Fragnesia Variant (fragnesia-5db89c99566fc) — Bypass of CVE-2026-46300 Patch V12 Security has released a fully functional PoC for a new bypass of the previously merged fix (commit f84eca581739) for CVE-2026-46300 (Fragnesia). This marks the latest iteration in the Dirty Frag family of Linux kernel Local Privilege Escalation (LPE) vulnerabilities targeting the XFRM ESP-in-TCP subsystem. 🔍 Root Cause (net/core/skbuff.c — skb_segment()) When constructing GSO segments from an skb that contains a frag_list, the SKBFL_SHARED_FRAG flag is propagated only from the head skb. Members of the frag_list carrying page-cache-backed fragments with the flag set lose this marker during segmentation. Consequence: the resulting segments bypass the skip_cow() check inside esp_input(), enabling AES-GCM decryption in-place directly over page cache pages — the exact same powerful primitive used by previous Dirty Frag and Fragnesia exploits. 🔬 Deterministic Trigger Chain 1. Three network namespaces connected via veth pairs (sender → forwarder → receiver). 2. Sender performs send() + splice() (from the same read-only file) on the identical TCP connection. 3. GRO coalescing on the forwarder merges both packets within the same NAPI poll: • send() → head skb (no flag) • splice() → frag_list (with SKBFL_SHARED_FRAG) 4. GSO is disabled on the forwarder’s egress interface, forcing skb_segment(). 5. The flag is lost on the generated segments. 6. Segments arrive at the receiver with ESP-in-TCP active, allowing controlled 1-byte arbitrary writes into the page cache via the AES-GCM keystream. The exploit iterates a small ELF payload, automatically locates and overwrites a SUID-root binary (with automatic backup), and spawns a root shell. The page cache modification is non-persistent on disk and can be cleared with drop_caches. ✅ Full working PoC (including skb_segment_exploit.c, Makefile and detailed README): https://github.com/v12-security/pocs/tree/main/fragnesia-5db89c99566fc 📌 References: • Original Fragnesia (CVE-2026-46300): https://github.com/v12-security/pocs/blob/main/fragnesia/README.md • V12 Security: https://v12.sh ❌ No patch is currently available in mainline or netdev trees for this bypass. Immediate Mitigation (identical to Dirty Frag / Fragnesia): • sudo modprobe -r esp4 esp6 rxrpc • Blacklist the modules esp4, esp6 and rxrpc System administrators and SOC teams should apply this mitigation immediately and monitor for XFRM/ESP module loading. #Linux #KernelLinux #CVE202646300 #Fragnesia #DirtyFrag #LPE #PrivilegeEscalation #XFRM #ESPinTCP #LinuxKernel #CyberSecurity #InfoSec #ThreatIntelligence #Vulnerability #OSINT #LinuxSecurity #KernelSecurity #RedTeam #BlueTeam #SysAdmin #DevOps #VulnMgmt #CyberThreat

Uwaga. Frangnesia (CVE-2026-46300) Kolejna poważna podatność w jądrze Linuxa. Local Privilege Escalation do root. Temat podobny do podatności copy fail/dirty frag.

Good stuff from Dwark!! - dwark says Astra was involved in the attack on huggingface but OpenAI says it was 5.6 sol, someone is wrong here - to escalate within OpenAI infrastructure the black hat talk specifically says they used a Linux kernel exploit that has a public CVE, “pte_physroot", which I am speculating is Fragnesia: CVE-2026-46300, published May 23 - why is everyone glossing over the fact that OpenAI’s agents were found to be coordinating with agents from another lab??

Fragnesia公開、Linux LPE 2週で3件目 Linuxカーネルにローカル権限昇格の脆弱性「Fragnesia」(CVE-2026-46300)が公開された。 Copy Fail、Dirty Fragに続き2週間で3つ目。 3件とも、ページキャッシュへの不正書き込みという同じバグクラスに属する。 Dirty Fragを発見したヒョンウ・キム氏は、Fragnesiaを「Dirty Frag修正パッチの意図しない副作用」と説明している。 修正そのものが、次の穴を露わにしている。 https://joho-todai.com/fragnesia-released-linux-lpe-third-exploit/

AIが見つけたLinuxカーネルの致命的脆弱性『Fragnesia』(CVE-2026-46300)の深層：Dirty Fragの再来と対策｜you2h https://zenn.dev/you2h/articles/20260520-etc-modprobe-d-disable-esp-con-94b8dde2 #zenn

ICYMI, Fragnesia (CVE-2026-46300) is a third recently disclosed Linux kernel local-root flaw. Every supported AlmaLinux release is affected, so patched kernels have been rolled out to production repositories/mirrors. https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/?utm_medium=social&utm_source=twitter

Dirty Fragの別のvariant "Fragnesia" に関するRed Hat製品の情報についてはこちらをご参照ください (今はまだほとんど情報がないですが随時更新されます) https://access.redhat.com/security/cve/cve-2026-46300

Linuxのカーネルまわりの脆弱性（最近のやつ）の整理（as of 5月18日） ・Copy Fail / CVE-2026-31431 ・Dirty Frag (Copy Fail 2) / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300 ・DirtyDecrypt (Fragnesia亜種) LPE連打が厄介。

Anyway, totally unrelated, was just thinking about the current CVE system where you have exploits coming out weeks before a CVE number or description: https://lore.kernel.org/linux-cve-announce/2026052311-CVE-2026-46300-27bc@gregkh/T/#u https://lore.kernel.org/linux-cve-announce/2026052309-CVE-2026-43503-b134@gregkh/T/#u

また universal な linux LPE だ...... (Fragnesia, CVE-2026-46300) 一応 Dirty Frag で対応していた人たちは緩和策ほぼ同じだろうからそれが救いか......

Linuxのカーネルまわりの脆弱性（最近のやつ）の整理： ・Copy Fail / CVE-2026-31431 ・Dirty Frag / CVE-2026-43284, CVE-2026-43500 ・Fragnesia / CVE-2026-46300 ・Fragnesia亜種 / CVE未採番 <- 5/16（日本時間）に登場した新種 たいていのディストリビューションで対処済みなのはFragnesiaまでで、最新のやつはどうなってるかケースバイケースです……。

What makes Fragnesia (CVE-2026-46300) deadlier than most LPEs: • Deterministic logic bug (no race condition) • Unprivileged user → arbitrary byte writes into kernel page cache • Directly overwrites read-only files like /usr/bin/su • One clean PoC run = instant root PoC already public.