Third Linux kernel root exploit in three weeks - 'Fragnesia' rides the same ESP-in-TCP code path as Dirty Frag and ships with a public proof-of-concept (CVE-2026-46300)

Six days after Dirty Frag was patched, researcher William Bowling and the V12 Security team disclosed Fragnesia - a separate Linux kernel bug in the same ESP-in-TCP networking code that lets any unprivileged local user become root in one command. The public proof-of-concept overwrites /usr/bin/su in memory using a logic flaw that loses track of shared socket-buffer fragments, then re-runs su to drop into a root shell. The on-disk binary is left untouched, which makes the change harder to spot. Tracked as CVE-2026-46300 (CVSS 7.8), it follows Copy Fail (April 29) and Dirty Frag (May 7) in the same family.

Check

List Linux hosts where untrusted users can get a shell (multi-tenant servers, container build farms, CI runners) and verify whether the esp4/esp6/rxrpc module blacklist from Dirty Frag is still in place.

Affected

All Linux kernels released before May 13, 2026, including AlmaLinux 8/9/10, CloudLinux 7h/8/9/10, RHEL, Ubuntu, Debian, and openSUSE. Requires unprivileged user namespace creation enabled.

Fix

Install the patched kernel from your distribution as it lands (AlmaLinux and CloudLinux first), or use KernelCare for rebootless livepatches. Interim mitigation: blacklist esp4, esp6, and rxrpc modules, then drop the page cache.