Major Linux distributions have begun deploying patches for a newly identified high-severity kernel vulnerability that enables attackers to execute malicious code with root privileges.

Dubbed Fragnesia and tracked under CVE-2026-46300, the flaw originates from a logic error in the Linux XFRM ESP-in-TCP subsystem. It allows unprivileged local attackers to escalate privileges to root by performing arbitrary byte writes to the kernel page cache of read-only files.

William Bowling, head of assurance at Zellic and the researcher who uncovered this universal local privilege escalation issue, has released a proof-of-concept exploit. The PoC establishes a kernel memory-write primitive, which corrupts the page cache of the /usr/bin/su binary to deliver a root shell on vulnerable systems.

Bowling noted that Fragnesia falls within the Dirty Frag vulnerability family, disclosed last week. It impacts all Linux kernels released before May 13, 2026. Similar to Fragnesia, Dirty Frag includes a public PoC that local attackers can leverage for root access on leading distributions.

In contrast, Dirty Frag combines two kernel bugs: the xfrm-ESP Page-Cache Write issue (CVE-2026-43284) and the RxRPC Page-Cache Write flaw (CVE-2026-43500). These enable privilege escalation through in-memory modifications of protected system files.

"Fragnesia is part of the Dirty Frag vulnerability class," Bowling stated. "It is a distinct bug in the ESP/XFRM subsystem that has its own dedicated patch. Still, it targets the same attack surface, and the mitigation matches that of Dirty Frag."

"The vulnerability exploits a logic bug in the Linux XFRM ESP-in-TCP subsystem to perform arbitrary byte writes into the kernel page cache of read-only files, without needing any race condition," he added.

Linux administrators are urged to install kernel updates as quickly as possible to safeguard their systems from potential attacks.

For those unable to patch immediately, the Dirty Frag mitigation - which unloads vulnerable kernel modules - offers temporary protection. Note that this disrupts AFS distributed network file systems and IPsec VPNs:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

The Fragnesia announcement arrives amid ongoing patch rollouts for "Copy Fail," another actively exploited privilege escalation vulnerability.

On May 1, CISA listed Copy Fail among known exploited flaws and mandated federal agencies to patch their Linux systems by May 15.

"Such vulnerabilities serve as common entry points for malicious actors and present substantial risks to federal networks," CISA cautioned. "Implement vendor-recommended mitigations, adhere to BOD 22-01 for cloud environments, or cease product use if fixes are unavailable."

Earlier in April, distributions addressed Pack2TheRoot, a long-undetected privilege escalation bug in the PackageKit daemon that had persisted for ten years.