Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruption
Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM (TL-2026-0510), also tracked as Fragnesia, is a high-severity software vulnerability, first published 2026-05-13. It has no confirmed attribution, affects Linux Kernel Linux Kernel — XFRM / espintcp ULP, maps to 26 MITRE ATT&CK techniques (T1003.008, T1005, T1014), and is covered by 9 detection rules and 23 indicators of compromise.
Key facts for TL-2026-0510
- Threat ID
- TL-2026-0510
- Also known as
- Fragnesia, DirtyFrag variant, ESP-in-TCP Page-Cache LPE
- Severity
- HIGH
- Status
- MONITORING
- Category
- VULNERABILITY
- First published
- 2026-05-13
- Last reviewed
- 2026-05-13
- Attribution confidence
- NONE
- Motivation
- UNKNOWN
- Target sectors
- technology, cloud, financial, government, healthcare, education, telecommunications, energy, manufacturing, retail
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 23
Malware and tooling in Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
Malware and tooling: None — local privilege escalation; no native C2 component, Wiz Fragnesia PoC
Fragnesia is a new Linux kernel local privilege escalation in the DirtyFrag family, disclosed by Wiz (Hyunwoo Kim) on 2026-05-13. A flaw in the XFRM ESP-in-TCP receive path lets in-place AES-GCM ESP decryption corrupt file-backed page-cache pages, giving an unprivileged local user a deterministic write primitive that elevates to root by overwriting /usr/bin/su in the page cache. No CVE has been assigned at disclosure; a public PoC exists.
How Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM works
Fragnesia is a Linux kernel local privilege escalation vulnerability disclosed on 2026-05-13 by Wiz researcher Hyunwoo Kim, who also reported the original DirtyFrag (CVE-2026-43284 / CVE-2026-43500). According to Wiz, Fragnesia emerged as an unintended side effect of one of the patches shipped for the original DirtyFrag, making it a true family variant rather than a coincidental name overlap.
The bug lives in Linux's XFRM ESP-in-TCP transport (the espintcp upper-layer protocol, or ULP, that encapsulates IPsec ESP inside TCP for NAT/firewall traversal). Specifically, the kernel mishandles shared page fragments during sk_buff (skb) coalescing on the TCP receive path. When a TCP segment carrying an ESP-in-TCP message is queued before the espintcp ULP is installed on the socket, the receive path is allowed to splice file-backed pages (pages obtained from the page cache via splice/sendfile-style fast paths) directly into the TCP receive queue as shared skb fragments. Once espintcp later takes over processing, it performs in-place AES-GCM ESP decryption on those buffers. Because the buffer is a shared reference to a page-cache page rather than a private kernel allocation, the keystream XOR happens directly against the cached page contents. The result is a deterministic single-byte (and, with chained operations, multi-byte) write primitive into read-only file pages from a fully unprivileged user-mode context.
Unlike the original DirtyFrag, Fragnesia does not require any host privileges to begin. The attacker is an ordinary local user with the ability to create user namespaces (the default on most modern desktop and many server Linux distributions). The attacker creates a new user namespace and a nested network namespace, which grants CAP_NET_ADMIN inside that namespace — enough to drive NETLINK_XFRM and install a crafted IPsec Security Association (SA) configured for ESP-in-TCP transport. The PoC then constructs a TCP socket pair, races the ESP-in-TCP ULP installation against ingress so that file-backed pages (mmap'd from the target file) end up referenced by the receive queue, and submits ESP packets whose AES-GCM keystream, when XOR'd over the cached page, produces the attacker-chosen plaintext.
Wiz's public PoC targets /usr/bin/su: a small ELF stub is layered over the cached page of su that calls setresuid(0,0,0) followed by execve("/bin/sh", ...). Because the modification lives only in the page cache, the on-disk binary is unchanged and the attack survives only as long as that page remains cached. Invoking su (which is setuid-root) loads the corrupted page, runs the attacker stub, and yields an interactive root shell. The same primitive trivially generalizes to other setuid binaries, kernel security policy files, or any file the attacker can keep cached.
Key distinguishing properties versus DirtyFrag: (1) no host-level privilege requirement; (2) deterministic, not probabilistic, write primitive; (3) write goes through page cache and is invisible on disk; (4) requires only unprivileged user namespaces plus reachable XFRM stack; (5) does not require any specific filesystem (DirtyFrag's COW path); (6) PoC is fully released with the disclosure. As of disclosure, no upstream patch is yet merged. Vendor advisories from major distributions are pending.
Recommended defenses, in order of strength: (a) blacklist esp4, esp6, and rxrpc kernel modules where IPsec is not required; (b) disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on Debian-family, or use the equivalent Lockdown / AppArmor restrictions on Ubuntu); (c) restrict CAP_NET_ADMIN inside containers and confined contexts; (d) drop page caches with echo 1 > /proc/sys/vm/drop_caches if suspect activity is observed; (e) deploy detections for unusual XFRM SA installations from unprivileged contexts and for setuid-binary execution following recent page-cache resident modifications. Apply upstream kernel patches as soon as they ship.
MITRE ATT&CK techniques used in TL-2026-0510
Credential Access
T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
Collection
Defense Evasion
T1014 Rootkit; T1070.004 Indicator Removal: File Deletion; T1564 Hide Artifacts; T1620 Reflective Code Loading
Execution
T1059.004 Command and Scripting Interpreter: Unix Shell; T1106 Native API; T1203 Exploitation for Client Execution
Privilege Escalation
T1068 Exploitation for Privilege Escalation; T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid; T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching; T1611 Escape to Host
Command and Control
T1071 Application Layer Protocol
Initial Access
T1078.003 Valid Accounts: Local Accounts
Discovery
T1082 System Information Discovery; T1613 Container and Resource Discovery
Persistence
T1098 Account Manipulation; T1543 Create or Modify System Process
Lateral Movement
T1210 Exploitation of Remote Services
Impact
Resource Development
T1587 Develop Capabilities; T1587.004 Develop Capabilities: Exploits; T1588.005 Obtain Capabilities: Exploits
defense-impairment
T1601.002 Modify System Image: Downgrade System Image; T1686 Disable or Modify System Firewall
Affected products and versions in Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
- Linux Kernel — Linux Kernel — XFRM / espintcp ULP
Vulnerable versions: Kernels carrying the original DirtyFrag (CVE-2026-43284/43500) patch up to disclosure date 2026-05-13; Mainline kernels with CONFIG_INET_ESPINTCP=y and XFRM enabled
Fixed in: Pending — no upstream fix merged as of 2026-05-13 - Canonical — Ubuntu
Vulnerable versions: 20.04 LTS; 22.04 LTS; 24.04 LTS; 25.04
Fixed in: Pending Canonical USN - Red Hat — Red Hat Enterprise Linux
Vulnerable versions: RHEL 8 (kernel-4.18 backport branch carrying DirtyFrag patch); RHEL 9; RHEL 10
Fixed in: Pending Red Hat RHSA - SUSE — SUSE Linux Enterprise / openSUSE
Vulnerable versions: SLES 15 SP5/SP6; openSUSE Leap 15.x; openSUSE Tumbleweed
Fixed in: Pending SUSE-SU - Debian — Debian GNU/Linux
Vulnerable versions: Debian 11 bullseye (LTS kernel); Debian 12 bookworm; Debian 13 trixie
Fixed in: Pending Debian DSA - Amazon — Amazon Linux 2 / 2023
Vulnerable versions: Amazon Linux 2 (5.10 / 5.15 LTS branches); Amazon Linux 2023
Fixed in: Pending Amazon ALAS
Remediation for Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
Patches
- No upstream Linux kernel patch merged at disclosure (2026-05-13). Track linux-kernel mailing list and distribution security trackers for the XFRM ESP-in-TCP coalescing fix.
- Monitor Ubuntu USN, Red Hat RHSA, SUSE SUSE-SU, Debian DSA, and Amazon Linux ALAS feeds for the eventual Fragnesia advisory.
Immediate actions
- Blacklist esp4, esp6, and rxrpc kernel modules where IPsec/ESP-in-TCP is not required: add 'blacklist esp4', 'blacklist esp6', 'blacklist rxrpc' to /etc/modprobe.d/ and run rmmod for any already-loaded instances
- Disable unprivileged user namespaces where business-compatible: sysctl -w kernel.unprivileged_userns_clone=0 (Debian/Ubuntu) or sysctl -w user.max_user_namespaces=0 (RHEL-family)
- On Ubuntu, keep AppArmor unprivileged-user-namespace restrictions enabled (default in 24.04+); they meaningfully raise the bar but do not fully mitigate
- Audit all hosts for unexpected XFRM Security Association installations from non-root UIDs and unusual user-namespace creation activity
- Drop page caches on suspect hosts as a containment step: echo 1 > /proc/sys/vm/drop_caches
Workarounds
- Module blacklisting of esp4/esp6 (no IPsec ESP support after reboot)
- Disable unprivileged user namespaces system-wide
- Use kernel command-line modules.blacklist=esp4,esp6 to prevent autoload
- Run untrusted workloads inside gVisor / Kata Containers to remove the host kernel attack surface entirely
Longer-term hardening
- Deploy EDR/auditd rules detecting NETLINK_XFRM SA installs from unprivileged contexts inside non-root user namespaces
- Adopt eBPF or auditd telemetry for setuid binary execution that correlates with recent page-cache pressure events
- Tighten container runtime defaults: drop CAP_NET_ADMIN, disable user namespaces for untrusted workloads, enforce seccomp filters blocking unshare(CLONE_NEWUSER|CLONE_NEWNET)
- Adopt kernel hardening configs (CONFIG_USER_NS=n where possible, CONFIG_NET_NS gated by capability, lockdown=integrity)
- Implement file integrity monitoring on /usr/bin/su, /usr/bin/sudo, /usr/bin/passwd and other setuid-root binaries — comparing on-disk hash to executing-process hash via auditd/Tracee
Weaknesses (CWE) in Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
CWE-362, CWE-1284, CWE-787, CWE-269, CWE-665
Timeline of Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
- Original DirtyFrag (CVE-2026-43284 and CVE-2026-43500) publicly disclosed by Wiz / Hyunwoo Kim — page-cache COW corruption in Linux.
- Upstream Linux kernel patch for original DirtyFrag merged. The patch's interaction with the espintcp ULP receive path inadvertently introduces the Fragnesia primitive.
- Hyunwoo Kim identifies that one of the DirtyFrag patches enables a new variant via XFRM ESP-in-TCP page-fragment coalescing (per Wiz timeline).
- Wiz Research privately reports Fragnesia to upstream Linux security (linux-distros / security@kernel.org) and major distribution security teams.
- 30-day embargo window opens with distributions; vendor patches are drafted but not yet merged.
- Threadlinqs Intelligence begins tracking as TL-2026-0510. Detection engineering and adversary simulation in progress.
- No CVE identifier assigned at disclosure. CVE request pending with MITRE.
- Public PoC released alongside disclosure — fully unprivileged local user to root via XFRM ESP SA installation in a nested user/network namespace.
- Wiz publishes the Fragnesia blog with full technical writeup and PoC demonstrating page-cache overwrite of /usr/bin/su for root shell.
- As of 2026-05-29, Fragnesia is now tracked as CVE-2026-46300 with an upstream skb_try_coalesce fix submitted 2026-05-13 and patched kernels rolling out (AlmaLinux/Fedora early; Ubuntu/Debian/SUSE/EL9 following; RHEL still expediting). It remains a live concern on unpatched hosts given the public PoC, but is not in CISA KEV and has no reported in-the-wild exploitation.
Sources cited for Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
- Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP (Wiz Research)
- Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — Original DirtyFrag-family disclosure (parent)
- Linux XFRM subsystem documentation — ESP-in-TCP transport (espintcp)
- RFC 8229 — TCP Encapsulation of IKE and IPsec Packets
- Linux kernel ESP-in-TCP ULP implementation (net/xfrm/espintcp.c)
- Unprivileged user namespaces — kernel.org admin guide
- Ubuntu AppArmor restrictions on unprivileged user namespaces
- Linux Kernel splice() / page-fragment skb internals
- Hyunwoo Kim — Researcher profile (Wiz / prior DirtyFrag credit)
Threats related to Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM
- CVE-2026-31431 "Copy Fail" — Linux Kernel algif_aead Deterministic Local Privilege Escalation Affecting All Major Distributions
- Linux Kernel 'Copy Fail' Local Privilege Escalation (CVE-2026-31431) — algif_aead 4-Byte Page Cache Write to setuid Root
- Linux Kernel 'Dirty Frag' Universal Local Privilege Escalation — xfrm-ESP & RxRPC Page-Cache Write (No CVE, Public PoC)
- Linux Kernel act_pedit COW Out-of-Bounds Write Enables Local Privilege Escalation to Root (CVE-2026-46331)
- RefluXFS: Linux Kernel XFS Copy-on-Write Race Condition Local Privilege Escalation (CVE-2026-64600)
- Linux Kernel FUSE Page-Cache Buffer Overflow (CVE-2026-31694) Enables Local Privilege Escalation
Detection coverage for TL-2026-0510
As of 2026-05-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0510 across Splunk SPL, Microsoft KQL and Sigma, covering 23 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.