Fragnesia (CVE-2026-46300) is a local privilege escalation vulnerability in the Linux kernel's XFRM ESP-in-TCP subsystem. The flaw arises from improper handling of socket buffer fragments, specifically a failure to propagate a shared page flag, which results in unsafe write operations that can be exploited by any local user to gain root privileges. A public proof-of-concept exploit has been demonstrated on Ubuntu systems. The vulnerability affects Linux kernels that have not applied the patch released on May 13, 2026. While module blacklisting used to mitigate the related Dirty Frag vulnerability also protects against Fragnesia, systems patched only for Dirty Frag remain vulnerable. Immediate remediation involves applying the official kernel patch or blacklisting the vulnerable module. No confirmed exploitation in the wild has been reported to date.

Successful exploitation of this vulnerability allows any local user to escalate privileges to root on affected Linux systems. This can lead to full system compromise, unauthorized access to sensitive data, and the ability to execute arbitrary code with kernel-level privileges. However, there are no reports of active exploitation in the wild at this time.

A patch addressing this vulnerability was released on May 13, 2026. Applying this official kernel update is the primary recommended mitigation. Alternatively, blacklisting the vulnerable kernel module provides protection but is less comprehensive. Systems patched only for the related Dirty Frag vulnerability remain vulnerable to Fragnesia, so ensure the specific Fragnesia patch or module blacklisting is applied. Monitor vendor advisories for updates and confirm patch application. No additional action is required if the May 13 patch has been applied.