Security researchers have disclosed a newly identified local privilege escalation vulnerability in the Linux Kernel, dubbed “Fragnesia,” which belongs to the broader Dirty Frag family of flaws. The issue, officially tracked as CVE-2026-46300, affects the Linux Kernel’s XFRM ESP-in-TCP subsystem and allows unprivileged local attackers to escalate privileges to root by corrupting page-cache memory.  The discovery of Fragnesia highlights how fixes for previous Linux Kernel vulnerabilities can unintentionally introduce new attack surfaces. According to researcher Hyunwoo Kim, who previously identified Dirty Frag, Fragnesia emerged as an unintended consequence of patches created to mitigate the original Dirty Frag vulnerabilities.  The vulnerability impacts a wide range of Linux distributions, many of which have already begun rolling out security updates. While a proof-of-concept exploit for Fragnesia is publicly available, researchers have stated that there is currently no confirmed evidence of active exploitation in real-world attacks. 

How Fragnesia Targets the Linux Kernel 

Fragnesia exploits a logic flaw within the Linux Kernel’s XFRM ESP-in-TCP implementation. Specifically, the vulnerability stems from improper handling of shared page fragments during socket buffer (skb) coalescing operations.  The attack abuses a condition where file-backed pages are inserted into a TCP receive queue before the socket transitions into ESP-in-TCP ultra-light protocol (ULP) mode. Once ESP processing is activated, the kernel decrypts queued data in-place. This process creates controlled corruption within the underlying page cache through manipulation of the AES-GCM keystream.  Researchers explained that the exploit leverages user and network namespaces to gain CAP_NET_ADMIN privileges inside an isolated namespace. Attackers can then install a specially crafted ESP security association using NETLINK_XFRM and repeatedly trigger controlled single-byte writes into cached file pages.  Using this approach, researchers successfully demonstrated overwriting the opening bytes of /usr/bin/su with a compact ELF payload. The payload executes setresuid(0,0,0) before launching /bin/sh, ultimately providing attackers with a root shell.  Importantly, the modified data exists only within page-cache memory and does not permanently alter the binary stored on disk. However, researchers warned that exploitation is not limited to /usr/bin/su. Any file readable by the user could potentially be modified, including highly sensitive files such as /etc/passwd. 

Relationship Between Fragnesia and Dirty Frag 

Fragnesia shares several characteristics with Dirty Frag and other recently disclosed Linux Kernel privilege escalation flaws, including Copy Fail. All of these vulnerabilities rely on corruption primitives that enable attackers to tamper with protected memory structures.  Microsoft’s threat intelligence team noted the similarities between Fragnesia and Dirty Frag in its analysis of the vulnerability.  “Similar to Dirty Frag, Fragnesia exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel,” Microsoft stated.  The company further explained:  “The primitive is then used to corrupt the page cache memory of the /usr/bin/su binary, which in turn leads to launching a shell with root privilege. Note that exploitation is not constrained to use the /usr/bin/su binary; it can modify any file readable by the user, including /etc/passwd.”  Microsoft also warned that Copy Fail has already been exploited in the wild. Shortly after Dirty Frag was disclosed, the company indicated that it may also have been leveraged in malicious attacks.  On May 8, Microsoft reported that telemetry from its Defender platform had identified limited activity that could indicate attempted exploitation involving either Dirty Frag or Copy Fail. At the time of publication, however, there were no additional public reports confirming exploitation of Dirty Frag or Fragnesia in active campaigns. 

Why XFRM ESP-in-TCP Matters 

The XFRM ESP-in-TCP subsystem plays a key role in enabling Encapsulating Security Payload (ESP) traffic over TCP connections within the Linux Kernel. Because ESP-in-TCP is used in certain VPN and encrypted networking scenarios, vulnerabilities affecting this component can expose critical systems to local privilege escalation attacks.  Fragnesia demonstrates how flaws in low-level networking components can lead to deterministic page-cache corruption, giving attackers powerful primitives capable of bypassing standard file protections.  Unlike some earlier Linux Kernel privilege escalation flaws, Fragnesia does not require host-level privileges before exploitation. This significantly lowers the barrier for local attackers operating within constrained environments.  Researchers also pointed out that AppArmor restrictions on unprivileged user namespaces, which are enabled by default on Ubuntu systems, may provide partial mitigation. However, additional bypasses could still allow successful exploitation under certain conditions. 

Mitigation and Security Recommendations 

Security experts strongly recommend that organizations apply vendor-provided Linux Kernel patches addressing Fragnesia and the underlying XFRM ESP-in-TCP vulnerability as soon as updates become available.  Until patches are fully deployed, administrators are advised to disable vulnerable modules associated with both Fragnesia and Dirty Frag if they are not required. Recommended commands include:  rmmod esp4 esp6 rxrpc  Administrators can also prevent the modules from loading by creating the following configuration:  printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/fragnesia.conf  Researchers additionally recommend restricting or disabling unprivileged user namespaces wherever operationally feasible. Monitoring systems for suspicious namespace creation, abnormal AF_ALG usage, or unauthorized XFRM manipulation may also help detect exploitation attempts.  If compromise is suspected, administrators should reboot affected systems or clear page-cache contents to remove modified in-memory binaries:  echo 1 | tee /proc/sys/vm/drop_caches  As Linux Kernel developers continue addressing Dirty Frag-related vulnerabilities, Fragnesia serves as another example of how security patches can unintentionally introduce new weaknesses into complex subsystems such as XFRM ESP-in-TCP. 

The Dirty Frag vulnerability affects Linux systems and allows root access escalation, while public PoC exploit code increases attack risks.

A newly disclosed local privilege escalation (LPE) vulnerability known as Dirty Frag is raising serious concerns across the Linux ecosystem after researchers revealed that the flaw can grant root access to most major Linux distributions. The vulnerability, which currently remains unpatched, has been described as a successor to the previously disclosed Copy Fail flaw tracked as CVE-2026-31431.  Security researcher Hyunwoo Kim, also known online as @v4bel, publicly disclosed the issue after what he described as a breakdown in the coordinated disclosure and embargo process. The vulnerability was initially reported to Linux kernel maintainers on April 30, 2026, but no official fixes or CVE identifiers had been assigned at the time of disclosure.  According to Kim, Dirty Frag is not a single bug but a vulnerability class capable of achieving root privileges across many Linux distributions by chaining together two separate flaws: the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.  Kim explained in his technical write-up:  “Dirty Frag is a vulnerability (class) that achieves root privileges on most Linux distributions by chaining the xfrm-ESP Page-Cache Write vulnerability and the RxRPC Page-Cache Write vulnerability.”  He further noted that Dirty Frag extends the same bug class associated with Dirty Pipe and Copy Fail (CVE-2026-31431). Unlike race-condition-based attacks, Dirty Frag operates through a deterministic logic flaw, making exploitation more reliable.  “Because it is a deterministic logic bug that does not depend on a timing window, no race condition is required, the kernel does not panic when the exploit fails, and the success rate is very high.” 

Dirty Frag Targets Multiple Linux Distributions 

The new LPE vulnerability affects a broad range of Linux distributions, including Ubuntu 24.04.4, RHEL 10.1, openSUSE Tumbleweed, CentOS Stream 10, AlmaLinux 10, and Fedora 44. Researchers warned that successful exploitation allows an unprivileged local user to escalate privileges and gain full root access.  In a public disclosure sent to the oss-security mailing list on May 8, 2026, Kim described Dirty Frag as a “universal Linux LPE” capable of compromising all major Linux distributions.  The disclosure stated:  “This is a report on ‘Dirty Frag’, a universal LPE that allows obtaining root privileges on all major distributions.”  Kim also emphasized that the impact closely resembles Copy Fail, or CVE-2026-31431, which has already been observed under active exploitation in the wild. 

How Dirty Frag Works 

The first component of Dirty Frag, the xfrm-ESP Page-Cache Write vulnerability, originates from the IPSec (xfrm) subsystem. Researchers said it provides attackers with a four-byte store primitive similar to CVE-2026-31431 and allows overwriting small portions of the kernel page cache.  However, exploitation through the xfrm-ESP path requires an unprivileged user to create a namespace. Ubuntu blocks this behavior through AppArmor restrictions, limiting the effectiveness of that exploit path on Ubuntu-based Linux distributions.  To bypass that limitation, Dirty Frag chains a second flaw: the RxRPC Page-Cache Write vulnerability.  Kim explained:  “RxRPC Page-Cache Write does not require the privilege to create a namespace, but the rxrpc.ko module itself is not included in most distributions.”  He added that while RHEL 10.1 does not ship the rxrpc.ko module by default, Ubuntu systems load it automatically. By combining both vulnerabilities, attackers can adapt exploitation techniques depending on the target environment.  “Chaining the two variants makes the blind spots cover each other. In an environment where user namespace creation is allowed, the ESP exploit runs first. Conversely, on Ubuntu, where user namespace creation is blocked but rxrpc.ko is built, the RxRPC exploit works.” 

Links to Older Linux Kernel Vulnerabilities 

Researchers traced the xfrm-ESP vulnerability back to a Linux kernel source code commit made in January 2017. Interestingly, the same commit was also identified as the root cause of another serious Linux kernel issue, CVE-2022-27666, a buffer overflow vulnerability with a CVSS score of 7.8 that affected multiple Linux distributions.  The RxRPC Page-Cache Write vulnerability, meanwhile, was reportedly introduced in June 2023.  Security firm CloudLinx stated in an advisory that the flaw exists in the “ESP-in-UDP MSG_SPLICE_PAGES no-COW fast path” and is reachable through the XFRM user netlink interface.  AlmaLinux also released a technical analysis explaining how the issue impacts kernel memory handling:  “The bug lives in the in-place decryption fast paths of esp4, esp6, and rxrpc: when a socket buffer carries paged fragments that are not privately owned by the kernel, the receive path decrypts directly over those externally-backed pages.”  According to the advisory, this behavior can expose or corrupt plaintext data while an unprivileged process still maintains a reference to the affected pages. 

Public PoC Increases Risk for Linux Distributions 

The threat level surrounding Dirty Frag has intensified due to the public release of a fully working proof-of-concept exploit. Researchers warned that the exploit can grant root access using a single command, significantly lowering the barrier for attackers.  Until official patches become available, administrators are urged to disable the affected modules manually. The recommended mitigation command is: 

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true" 

Security experts also warned that Dirty Frag importantly differs from CVE-2026-31431. Unlike Copy Fail, Dirty Frag can still be exploited even if the Linux kernel’s algif_aead module has been disabled.  Kim stated:  “Note that Dirty Frag can be triggered regardless of whether the algif_aead module is available.”  He further cautioned:  “In other words, even on systems where the publicly known Copy Fail mitigation (algif_aead blacklist) is applied, your Linux is still vulnerable to Dirty Frag.”  With no patches currently available and exploit code already circulating publicly, the newly disclosed Dirty Frag LPE vulnerability presents a significant risk to Linux distributions worldwide.