Fragnesia Linux Root Exploit Hits Every Kernel Before May 13

A new Linux root-shell exploit named Fragnesia landed publicly on May 13, 2026, and any unprivileged local user with shell access can run it in a single command. The flaw is tracked as CVE-2026-46300 with a CVSS score of 7.8. Every Linux kernel shipped before May 13, 2026 is exposed. It abuses a logic bug in the kernel’s XFRM ESP-in-TCP path to rewrite the in-memory copy of /usr/bin/su, injecting a stub that fires off a root shell. The on-disk binary is never modified.

Discovered by researcher William Bowling and the V12 security team, Fragnesia is the third Linux local privilege escalation to drop in three weeks. The lineage is uncomfortable. The upstream patch that closed Dirty Frag (kernel commit f4c50a4034e6) added code that trusts a marker that is not, in fact, accurate, and Bowling’s candidate follow-up patch carries a Fixes tag pointing at a 2013 kernel commit. Codenamed Fragnesia, the security vulnerability is tracked as CVE-2026-46300 (CVSS score: 7.8) and is rooted in the Linux kernel’s XFRM ESP-in-TCP subsystem, discovered by researcher William Bowling of the V12 security team.

Inside The Exploit: A Six-Step Recipe For Root

Fragnesia turns a sequence of ordinary kernel calls into an arbitrary-byte write directly into the page cache of a setuid binary. The vulnerability allows any local unprivileged user to escalate privileges to root without requiring a race condition, making it one of the more reliable local privilege escalation exploits seen in recent years. No timing window. No kernel panic on failure. No exotic precondition.

The mechanics start with namespace gymnastics. The exploit calls unshare(CLONE_NEWUSER | CLONE_NEWNET) to obtain a namespace where it holds CAP_NET_ADMIN without any real privileges on the host. Inside that sandbox, the exploit installs an ESP-in-TCP security association using AES-128-GCM with a known key and SPI 0x100, then builds a one-time keystream lookup table that maps every possible byte value to a matching nonce.

The corruption itself happens in six clean steps. The public README walks through them in the V12 Fragnesia proof-of-concept code and write-up on GitHub:

1. Create a user and network namespace with unshare, gaining CAP_NET_ADMIN without host privileges.
2. Install an ESP-in-TCP security association via NETLINK_XFRM using AES-128-GCM with a known key.
3. Build a 256-entry keystream table by varying the IV nonce through AF_ALG to reach every possible stream byte.
4. Splice file pages into the TCP receive queue before the socket transitions into espintcp ULP mode.
5. Enable espintcp so the kernel decrypts the queued ESP record in place, XORing keystream bytes directly into the cached file page.
6. Execute /usr/bin/su, which now runs an injected ELF stub that calls setresuid(0,0,0) and drops a shell.

The Patch That Spawned The Next Patch

This is the part defenders need to sit with. Fragnesia is not a re-announcement of Dirty Frag. Dirty Frag works by chaining two separate kernel flaws, the xfrm-ESP Page-Cache Write vulnerability (CVE-2026-43284) and a RxRPC Page-Cache Write security issue (CVE-2026-43500), to achieve privilege escalation by modifying protected system files in memory. Fragnesia attacks the same surface but through a different invariant violation.

The bug lives several layers deeper than ESP processing itself. The underlying flaw is in the core socket-buffer code: skb_try_coalesce() failed to propagate the SKBFL_SHARED_FRAG marker when transferring paged fragments between buffers, so the kernel could lose track of the fact that a fragment was externally backed (e.g. by page-cache pages spliced in from a file). The XFRM ESP-in-TCP receive path would then perform in-place AES-GCM decryption directly over those page-cache pages, allowing an unprivileged user to XOR a chosen keystream byte into a read-only file’s cache page.

That breaks the assumption the original Dirty Frag fix relied on. Fragnesia is not a totally separate bug class from Dirty Frag. It is another exploit path through the same ESP/XFRM attack surface, and the original upstream Dirty Frag fix does not fully stop it. The candidate follow-up patch sitting on the netdev mailing list is a two-line change to skb_try_coalesce() that preserves the shared-frag flag during fragment transfer. The Fixes tag points back to a 2013 commit, which means the underlying invariant has been wrong for roughly 13 years.

The public disclosure thread was opened on May 13 by Gentoo developer Sam James to the oss-security list. The oss-security Fragnesia disclosure post by Sam James bundles the PoC source, the netdev patch, and the V12 advisory in a single message.

V12 attributes part of the discovery to its agentic AI tooling. V12 Security attributes part of the discovery process to agentic AI-assisted security tooling, and regardless of how much weight you give that claim, the cadence of exploit iteration is accelerating. The fact that the candidate fix carries a Fixes: tag pointing at a 2013 commit also suggests the bug class isn’t exhausted – there are probably more invariant violations in the same code path waiting to be found. Defenders should assume this bug class is not finished evolving.

Who’s Exposed Right Now

The blast radius is broad and specific at the same time. Every supported AlmaLinux release is affected. Every Ubuntu LTS kernel without the May 13 backport is affected. RHEL, CentOS Stream, Fedora, openSUSE, Debian, and Amazon Linux are all in the same bucket until distribution patches land. The AlmaLinux Fragnesia disclosure-day advisory and patched-kernel announcement notes that its core team built and shipped fixes ahead of upstream because exploitation looked trivial.

• CVE-2026-46300: the assigned identifier, CVSS 7.8.
• Ubuntu 6.8.0-111-generic: the confirmed test target on a single-command exploit.
• May 13, 2026: the netdev patch publication date that marks the kernel cutoff.
• 2013: the year of the kernel commit referenced in the candidate fix’s Fixes tag.
• Three: the number of universal Linux LPEs disclosed since April 29.

Mitigation Costs: Kill ESP, Lose IPsec

The interim mitigation is identical to the Dirty Frag one, and it carries the same operational price. Operators run rmmod against esp4, esp6, and rxrpc, then write an install-blacklist file under /etc/modprobe.d/ so the modules cannot be loaded again. The exploit’s attack surface disappears.

So does kernel-mode IPsec. esp4 / esp6 are the kernel-side ESP transforms used by IPsec. Disabling them breaks IPsec tunnels that rely on the kernel data path on the affected machine. Do not apply this mitigation on hosts that terminate or transit IPsec / strongSwan / Libreswan tunnels. Hosts that act as IPsec endpoints will lose connectivity the moment the modules unload. AFS clients lose their RxRPC transport.

WireGuard and OpenVPN users get a pass. Both stacks live outside the espintcp data path. If you are routing traffic through kernel-mode IPsec tunnels, those tunnels will break. If you use WireGuard (which runs in userspace, not through the espintcp path) or OpenVPN, you are not affected by the mitigation. If you are running IPsec, evaluate a userspace fallback before unloading the modules.

Microsoft’s Dirty Frag advisory frames the broader operational threat model that applies equally to Fragnesia. Local privilege escalation vulnerabilities are frequently used by threat actors after initial access to expand control over a compromised environment. Once root access is obtained, attackers can disable security tooling, access sensitive credentials, tamper with logs, pivot laterally, and establish persistent access. The Microsoft Security Blog post on active Dirty Frag attacks and post-compromise risk documents limited in-the-wild activity tied to the same module surface Fragnesia exploits.

Why Defenders Can’t See Page-Cache Tampering

Standard file-integrity tools are blind to this attack pattern. The on-disk /usr/bin/su byte sequence never changes. A tripwire comparing hashes against a known-good baseline returns clean every time. The Wiz Threat Intel advisory on the Fragnesia page-cache corruption primitive says the deterministic write primitive sits entirely in kernel memory.

The vulnerability allows unprivileged local attackers to modify read-only file contents in the kernel page cache and achieve root privileges through a deterministic page-cache corruption primitive.

That quote, from the Wiz Research team writing on May 13, captures the detection problem cleanly. The tampered su binary persists in memory until either a reboot or an explicit page-cache drop. Anyone who runs su on a compromised host between exploit time and reboot inherits the root shell. Forensics that depends on disk artifacts will turn up nothing.

The recommended cleanup is one command, but it is non-negotiable after suspected exploitation. The Fragnesia exploit works by corrupting page-cache pages of sensitive files (such as /usr/bin/su). If you suspect the system may have already been targeted before you applied the mitigation, drop the page cache so any tampered pages are evicted and the next read comes fresh from disk: … This is safe to run on a live system (it only frees clean cache and dentry/inode entries) and pairs well with the blacklist above. echo 1 | tee /proc/sys/vm/drop_caches handles the eviction.

Three Linux LPEs In Three Weeks: The AI-Accelerated Pattern

Fragnesia is the third Linux root flaw to drop since late April. Fragnesia is the third Linux kernel privilege escalation requiring a patch and reboot on affected hosts in just three weeks, following Copy Fail (April 29) and Dirty Frag (May 7). Each was discovered with assistance from automated or agentic security tooling. Each modifies the page cache without touching disk.

The first in the chain was Copy Fail. Developers of major Linux distributions have begun shipping patches to address a local privilege escalation (LPE) vulnerability arising from a logic flaw. The newly disclosed LPE, dubbed Copy Fail (CVE-2026-31431), comes from a vulnerability in the Linux kernel’s authencesn cryptographic template. “An unprivileged local user can write four controlled bytes into the page cache of any readable file on a Linux system, and use that to gain root,” the writeup from security biz Theori explains. CISA added Copy Fail to its Known Exploited Vulnerabilities catalog on May 1, with a federal remediation deadline of May 15.

Dirty Frag arrived a week later, surfaced by Korean researcher Hyunwoo Kim. The Cloud Security Alliance’s CSA research note on Dirty Frag as an AI/ML infrastructure zero-day warned that page-cache attacks bypass traditional file-integrity monitoring and that AI inference hosts and Kubernetes nodes share the same page cache across all containers.

The pattern goes deeper than three bugs. Anthropic disclosed last week that its Mythos Preview model had autonomously chained kernel vulnerabilities to root a Linux host as part of Project Glasswing, Anthropic’s open-source kernel security partnership announcement. The Record’s reporting on Dirty Frag noted that AI tooling has compressed vulnerability hunting from years to weeks.

Bowling, who heads assurance at Zellic and runs V12, summarized the technical class concisely on May 13. “Fragnesia is a member of the Dirty Frag vulnerability class,” he wrote in the advisory. “This is a separate bug in the ESP/XFRM from dirtyfrag which has received its own patch. However, it is in the same surface and the mitigation is the same as for dirtyfrag. It abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files, without requiring any race condition.”

The cycle is not finished. The development comes as a threat actor named “berz0k” has been observed advertising on cybercrime forums a zero-day Linux LPE exploit for $170,000, claiming it works on multiple major Linux distributions. “The threat actor claims the vulnerability is TOCTOU-based (Time-of-Check Time-of-Use), capable of stable local privilege escalation without causing system crashes, and leverages a shared object (.so) payload dropped into the /tmp directory,” ThreatMon said in a post on X.

One operational lesson keeps repeating. The XFRM ESP code path was written for a world where IPsec mattered to almost no userspace developer. It now sits in the same blast radius as splice, sendfile, and the page cache. Defenders should plan for at least one more disclosure in this surface before the bug class is exhausted.

Frequently Asked Questions

Am I Still Vulnerable If I Already Patched Dirty Frag?

Yes. The upstream Dirty Frag fix did not close Fragnesia. The bug is a separate invariant violation in skb_try_coalesce() that became practically exploitable only after the Dirty Frag patch landed on May 8. Apply your distribution’s May 13 kernel update or, if no patched kernel is available yet, run the rmmod and modprobe blacklist commands for esp4, esp6, and rxrpc. Then drop the page cache with echo 1 | tee /proc/sys/vm/drop_caches before granting shell access again.

Will The Mitigation Break My VPN?

It will break kernel-mode IPsec tunnels. esp4 and esp6 are the IPsec transforms in the Linux data path, so any host running strongSwan or Libreswan as an endpoint or transit node will lose tunnel traffic the moment the modules unload. WireGuard runs entirely in userspace and is unaffected. OpenVPN is also unaffected. If you depend on kernel IPsec, evaluate a userspace fallback or wait for the patched kernel rather than running the blacklist.

How Do I Tell If My System Has Been Exploited?

Traditional file-integrity monitoring will not detect Fragnesia because the on-disk /usr/bin/su binary is never modified. Hunt for anomalous setuid binary execution from unexpected user contexts, namespace creation by unprivileged accounts, and unusual splice or sendmsg syscall patterns in audit logs. After remediation, drop the page cache with echo 1 | tee /proc/sys/vm/drop_caches and reboot. Treat any successful exploitation as full host compromise and rotate credentials accessed from the host.

When Will Patched Kernels Reach My Distribution?

AlmaLinux and CloudLinux shipped patched kernels in their testing streams on May 13. Ubuntu, Debian, and openSUSE typically follow within 24 to 72 hours of a netdev patch for a critical kernel CVE. RHEL backports usually arrive within a week. Monitor your distribution’s security mailing list and the upstream stable kernel branches. If you cannot wait, KernelCare and other livepatch services were preparing rebootless backports as of disclosure day.

Does This Bug Affect Containers Or Kubernetes Nodes?

Yes, in a particularly nasty way. The Linux page cache is shared between the host kernel and every container running on it. An attacker with shell inside an unprivileged container can corrupt the host’s cached copy of /usr/bin/su and escape to root on the node. Multi-tenant Kubernetes clusters, CI runners that execute untrusted code, and AI inference pipelines that expose interactive shells are the highest-risk environments. Patch nodes first, then drain and recycle workloads.

Fragnesia closes a strange chapter that has lasted three weeks and likely is not over. The same code path produced Copy Fail, Dirty Frag, and now this, and the candidate fix’s pointer at a 13-year-old commit suggests the auditors are still finding new ways to misuse old assumptions. For server operators, the right reflex over the next 48 hours is the same one Microsoft, AlmaLinux, and Wiz are all converging on: patch, then drop caches, then verify what the host was doing while it was exposed.

Disclaimer: This article covers a publicly disclosed Linux kernel vulnerability and the recommended remediation steps published by V12 Security, AlmaLinux, Wiz, and Microsoft as of May 14, 2026. The information is for general awareness only and should not replace formal incident response procedures. System administrators should validate every patch and module-blacklist change in a controlled environment before production deployment and consult their security operations team for environment-specific guidance. Vendor advisories and CVE scoring may change as further analysis is published.