New Fragnesia Linux Kernel LPE Grants Root Access via Page Cache Corruption

A new Linux kernel vulnerability called Fragnesia (CVE-2026-46300) allows unprivileged local attackers to gain root access through page cache corruption.

• •The vulnerability exists in the Linux kernel's XFRM ESP-in-TCP subsystem and was discovered by researcher William Bowling of the V12 security team
• •It enables deterministic page-cache corruption that modifies read-only file contents without requiring race conditions
• •The exploit corrupts the /usr/bin/su binary in kernel page cache to grant root privileges on all major Linux distributions
• •Multiple Linux distributions including Red Hat, Ubuntu, Debian, and Amazon Linux have released security advisories and patches
• •Mitigations include AppArmor restrictions, disabling ESP/XFRM functionality, and restricting local shell access until patches are applied