TLP:CLEARSECURITY ADVISORYHRK-SA-2026-1030-09Exploited in the wild
Fragnesia (CVE-2026-46300): Linux kernel local privilege escalation to root
A logic bug in the kernel XFRM ESP-in-TCP path lets an unprivileged local user write to the page cache of read-only files and escalate to root. Public exploit code targets the page cache of /usr/bin/su. It affects kernels released before May 13, 2026, and is now in CISA KEV. Patch the kernel, then prove the running version.
SEVERITY
High
PEAK CVSS
7.8
AUTH REQUIRED
Local
PUBLIC POC
Yes
PUBLISHED
Oct 30, 2026
REVISION
v1.0 · @Melly
01 · EXECUTIVE SUMMARY
Bottom line
Hayrok Research Lab is tracking Fragnesia, a Linux kernel local privilege escalation in the XFRM ESP-in-TCP subsystem. An unprivileged local user can write arbitrary bytes into the page cache of read-only files and escalate to root, and public exploit code targets the cached copy of a setuid binary. It affects kernels released before May 13, 2026, across every major distribution, and is now in CISA KEV. This is a second-stage flaw: it turns a foothold into full root.
KEY JUDGMENTS
01
Public, working proof-of-concept code exists and targets the page cache of /usr/bin/su. CISA added CVE-2026-46300 to its KEV catalog, with a late-October deadline.Observed
02
Fragnesia is a privilege escalation, not initial access. An attacker needs local code execution first, which pairs it with a reachable RCE such as the web-facing flaws in this series.Assessed
03
It affects kernels released before May 13, 2026, across Ubuntu, RHEL, Fedora, Debian, SUSE, AlmaLinux and Amazon Linux. The running kernel decides exposure, not the package name.Reproduced
04
It is the third XFRM-path privilege escalation in weeks, after Copy Fail and Dirty Frag. The ESP-in-TCP attack surface is producing repeat flaws.Assessed
Page-cache write of read-only files, CWE-456 / CWE-269
Vector
Local, unprivileged. No race condition required
Affected
Kernels released before May 13, 2026, all major distros
Scoring
7.8 · CVSS v3.1
Impact
Local privilege escalation to root. Public PoC available.
EXPOSURE: AN UNPATCHED KERNEL PLUS A FOOTHOLD
01Kernel before May 13, 2026Without a vendor backport for CVE-2026-46300.
02XFRM ESP-in-TCP presentThe subsystem is built into mainstream distro kernels.
03Local code executionAn attacker already runs code as an unprivileged user.
04Multi-tenant or exposed hostShared hosts and containers raise the stakes.
03 · THREAT ACTIVITY
Exploitation status and timeline
IN THE WILDIn KEVAdded to CISA KEV, late-Oct deadline.
PUBLIC POCAvailableWorking PoC targets /usr/bin/su.
STAGEPrivilege escalationNeeds a local foothold first.
PATCHAvailableDistro kernel updates from May 13.
DISCLOSURE AND ACTIVITY TIMELINE · 2026
May 13The kernel fix lands upstream. Kernels released before this date are affected.
May 14Fragnesia is disclosed as the third XFRM-path LPE after Copy Fail and Dirty Frag, with a public PoC.
OctCISA adds CVE-2026-46300 to KEV, confirming exploitation and setting a federal deadline.
04 · AFFECTED PRODUCTS
Affected and fixed versions
The running kernel decides exposure, not the package version string. A host that has not rebooted into a patched kernel is still vulnerable even after the package updates.
DISTRIBUTION
AFFECTED
FIXED IN
STATUS
Ubuntu
kernels before May 13, 2026
vendor kernel update
Fixed
RHEL, AlmaLinux, Fedora
kernels before May 13, 2026
vendor kernel update
Fixed
Debian, SUSE, Amazon Linux
kernels before May 13, 2026
vendor kernel update
Fixed
Appliances with bundled VPN
kernels above 4.11 with VPN server
vendor firmware update
Check vendor
REBOOT REQUIREDA kernel package update does not take effect until the host reboots into the patched kernel. Until then, the running kernel is still vulnerable. Treat the reboot as part of remediation.
05 · RECOMMENDED ACTIONS
What to do, in priority order
CriticalImmediately
Multi-tenant and shared hostsPatch the kernel and reboot. Any user who can run code can reach root.
Hosts also exposed to a reachable RCEPrioritize: Fragnesia is the escalation half of a full chain.
HighWithin the patch window
All Linux servers and container hostsApply the vendor kernel update and schedule the reboot.
Appliances with a bundled VPN serverCheck the vendor advisory and apply firmware updates.
Golden images and base imagesRebuild on a patched kernel so new hosts are not born vulnerable.
HighBefore closing
Every hostRecord the running kernel version after reboot as evidence, not just the installed package.
WORKAROUNDS
Patch and reboot. Applying the vendor kernel and rebooting into it is the remediation. There is no durable config-only fix.Limit local code execution. Reduce who can run code on shared hosts, and tighten container escape controls.Segment. Use segmentation so a single-host root does not become lateral movement.Watch setuid binaries. Monitor for integrity changes to cached setuid binaries such as su.
06 · DETECTION AND HUNTING
Observables and hunting queries
The PoC modifies the page cache rather than the on-disk binary, so file-hash checks of the binary on disk can miss it. Hunt on kernel version and on anomalous privilege gains.
TYPE
OBSERVABLE
SOURCE
Exposure
A running kernel from before May 13, 2026 without a backport
uname -r, vendor changelog
Behavior
An unprivileged process gaining root without a known sudo path
Process and auth telemetry
Behavior
Unexpected use of a setuid binary such as su after local access
auth logs, EDR
EXPOSURE · CVE-2026-46300the running kernel
uname -r
EXPOSURE · CVE-2026-46300is the fix in the kernel changelog
Fragnesia is a logic bug in the kernel's ESP-in-TCP path, part of the XFRM subsystem that handles IPsec. The flaw lets an unprivileged local user write arbitrary bytes into the page cache of read-only files. Because the kernel serves file contents from the page cache, corrupting that cache changes what the system reads from a protected file without touching the file on disk.
The public exploit targets the page-cache copy of /usr/bin/su, a setuid-root binary. By rewriting the cached copy, the attacker makes the kernel execute attacker-controlled bytes with root privileges, which yields a root shell. No race condition is required, which makes it reliable. Fragnesia is the third flaw in this XFRM attack surface after Copy Fail and Dirty Frag, and it carries a public, working PoC, so the gap between disclosure and use is short.
01 FOOTHOLD
Attacker has local code execution as a normal user
Copy Fail, the first of the three recent XFRM privilege escalations.
AssessedFragnesia is the escalation half of a full compromise. Paired with any reachable RCE in this series, a foothold becomes root on an unpatched, unrebooted host.
09 · VALIDATION
Confirm remediation
An installed kernel package is not a verdict. Each host should end with evidence: a patched kernel actually running after reboot, or exposed.
01
Read the running kernel, not the package
The booted kernel is what matters.
uname -r
02
Confirm the fix is present
Check the vendor changelog for the CVE, and that the running kernel postdates May 13, 2026.
This advisory will be updated as exploitation activity or vendor guidance changes.
12 · FAQ
Is Fragnesia being exploited?
A public, working proof-of-concept exists, and CISA added CVE-2026-46300 to its KEV catalog with a federal deadline.
Does Fragnesia give remote access?
No. It is a local privilege escalation. An attacker needs local code execution first, then uses Fragnesia to reach root.
I updated the kernel package. Am I safe?
Not until the host reboots into the patched kernel. The running kernel is what is vulnerable, not the installed package.
Which systems are affected?
Linux kernels released before May 13, 2026, across all major distributions, plus some appliances that bundle a VPN server.
VALIDATE YOUR EXPOSURE
Prove your kernel exposure
Hayrok reads the running kernel on each host, flags hosts pending a reboot, and maps where a local foothold could chain to root. Every result lands in Evidence Fabric.