Fragnesia (CVE-2026-46300) Linux Kernel XFRM ESP-in-TCP Loca...

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc
• Blog Title: Fragnesia (CVE-2026-46300): Linux Kernel XFRM ESP-in-TCP Local Privilege Escalation
• Suggested Section: Linux Hardening -> Linux Privilege Escalation -> Linux Kernel / Page Cache Corruption / XFRM ESP-in-TCP Fragnesia CVE-2026-46300

🎯 Content Summary

Overview

Fragnesia, tracked as CVE-2026-46300, is a high-severity Linux kernel local privilege escalation vulnerability in the kernel XFRM ESP-in-TCP subsystem. Tenable describes it as a new Linux kernel LPE affecting the same general subsystem abused by Dirty Frag, but requiring a separate kernel patch. It was publicly disclosed on May 13, 2026 by William Bowling of V12 Security, togeth...

🔧 Technical Details

Page-cache corruption through lost shared-buffer metadata: A kernel subsystem can become exploitable when it coalesces or transforms buffers but fails to preserve metadata that describes ownership or sharing. In Fragnesia, skb_try_coalesce() drops SKBFL_SHARED_FRAG, so later ESP-in-TCP processing treats shared file-cache-backed pages as private writable packet data. The general auditing lesson is to inspect zero-copy networking, skb coalescing, crypto, decryption, compression, and in-place transformation paths for lost "shared", "readonly", or "page-cache-backed" flags before any write occurs.

Namespace-assisted access to privileged kernel attack surface: The exploit pattern uses unprivileged user and network namespaces to obtain namespace-scoped CAP_NET_ADMIN. This does not grant host root directly, but it exposes complex networking/XFRM functionality to a local user. In similar Linux LPE research, unpri...

🤖 Agent Actions

Done.

Updated:

• src/linux-hardening/privilege-escalation/write-to-root.md

Added:

• page-cache-only overwrite of readable privileged files
• XOR-style page-cache write primitives
• namespace-assisted reachability via user+network namespaces / CAP_NET_ADMIN
• technical detection/mitigation notes
• references to the Tenable post, V12 PoC, and netdev patch

Validation:

• basic markdown structure checks passed
• mdbook build could not be run because mdbook is not installed in this environment (EXIT:127)

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc

Content Categories: Based on the analysis, this content was categorized under "Linux Hardening -> Linux Privilege Escalation -> Linux Kernel / Page Cache Corruption / XFRM ESP-in-TCP Fragnesia CVE-2026-46300".

Repository Maintenance:

• MD Files Formatting: 974 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0