# Fragnesia — DirtyFrag-Family Linux Kernel LPE via XFRM ESP-in-TCP Page-Cache Corruption

> Fragnesia is a new Linux kernel local privilege escalation in the DirtyFrag family, disclosed by Wiz (Hyunwoo Kim) on 2026-05-13. A flaw in the XFRM ESP-in-TCP receive path lets in-place AES-GCM ESP decryption corrupt file-backed page-cache pages, giving an unprivileged local user a deterministic write primitive that elevates to root by overwriting /usr/bin/su in the page cache. No CVE has been assigned at disclosure; a public PoC exists.

- **Published:** 2026-05-13T12:00:00Z
- **Last reviewed:** 2026-05-13T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0510
- **ID:** TL-2026-0510
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** MONITORING
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Fragnesia is a Linux kernel local privilege escalation vulnerability disclosed on 2026-05-13 by Wiz researcher Hyunwoo Kim, who also reported the original DirtyFrag (CVE-2026-43284 / CVE-2026-43500). According to Wiz, Fragnesia emerged as an unintended side effect of one of the patches shipped for the original DirtyFrag, making it a true family variant rather than a coincidental name overlap.

The bug lives in Linux's XFRM ESP-in-TCP transport (the espintcp upper-layer protocol, or ULP, that encapsulates IPsec ESP inside TCP for NAT/firewall traversal). Specifically, the kernel mishandles shared page fragments during sk_buff (skb) coalescing on the TCP receive path. When a TCP segment carrying an ESP-in-TCP message is queued before the espintcp ULP is installed on the socket, the receive path is allowed to splice file-backed pages (pages obtained from the page cache via splice/sendfile-style fast paths) directly into the TCP receive queue as shared skb fragments. Once espintcp later takes over processing, it performs in-place AES-GCM ESP decryption on those buffers. Because the buffer is a shared reference to a page-cache page rather than a private kernel allocation, the keystream XOR happens directly against the cached page contents. The result is a deterministic single-byte (and, with chained operations, multi-byte) write primitive into read-only file pages from a fully unprivileged user-mode context.

Unlike the original DirtyFrag, Fragnesia does not require any host privileges to begin. The attacker is an ordinary local user with the ability to create user namespaces (the default on most modern desktop and many server Linux distributions). The attacker creates a new user namespace and a nested network namespace, which grants CAP_NET_ADMIN inside that namespace — enough to drive NETLINK_XFRM and install a crafted IPsec Security Association (SA) configured for ESP-in-TCP transport. The PoC then constructs a TCP socket pair, races the ESP-in-TCP ULP installation against ingress so that file-backed pages (mmap'd from the target file) end up referenced by the receive queue, and submits ESP packets whose AES-GCM keystream, when XOR'd over the cached page, produces the attacker-chosen plaintext.

Wiz's public PoC targets /usr/bin/su: a small ELF stub is layered over the cached page of su that calls setresuid(0,0,0) followed by execve("/bin/sh", ...). Because the modification lives only in the page cache, the on-disk binary is unchanged and the attack survives only as long as that page remains cached. Invoking su (which is setuid-root) loads the corrupted page, runs the attacker stub, and yields an interactive root shell. The same primitive trivially generalizes to other setuid binaries, kernel security policy files, or any file the attacker can keep cached.

Key distinguishing properties versus DirtyFrag: (1) no host-level privilege requirement; (2) deterministic, not probabilistic, write primitive; (3) write goes through page cache and is invisible on disk; (4) requires only unprivileged user namespaces plus reachable XFRM stack; (5) does not require any specific filesystem (DirtyFrag's COW path); (6) PoC is fully released with the disclosure. As of disclosure, no upstream patch is yet merged. Vendor advisories from major distributions are pending.

Recommended defenses, in order of strength: (a) blacklist esp4, esp6, and rxrpc kernel modules where IPsec is not required; (b) disable unprivileged user namespaces (sysctl kernel.unprivileged_userns_clone=0 on Debian-family, or use the equivalent Lockdown / AppArmor restrictions on Ubuntu); (c) restrict CAP_NET_ADMIN inside containers and confined contexts; (d) drop page caches with echo 1 > /proc/sys/vm/drop_caches if suspect activity is observed; (e) deploy detections for unusual XFRM SA installations from unprivileged contexts and for setuid-binary execution following recent page-cache resident modifications. Apply upstream kernel patches as soon as they ship.

## MITRE ATT&CK

- T1587 Develop Capabilities
- T1587.004 Develop Capabilities: Exploits
- T1588.005 Obtain Capabilities: Exploits
- T1078.003 Valid Accounts: Local Accounts
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1106 Native API
- T1203 Exploitation for Client Execution
- T1098 Account Manipulation
- T1543 Create or Modify System Process
- T1068 Exploitation for Privilege Escalation
- T1548.001 Abuse Elevation Control Mechanism: Setuid and Setgid
- T1548.003 Abuse Elevation Control Mechanism: Sudo and Sudo Caching
- T1611 Escape to Host
- T1014 Rootkit
- T1070.004 Indicator Removal: File Deletion
- T1686 Disable or Modify System Firewall
- T1620 Reflective Code Loading
- T1601.002 Modify System Image: Downgrade System Image
- T1564 Hide Artifacts
- T1003.008 OS Credential Dumping: /etc/passwd and /etc/shadow
- T1082 System Information Discovery
- T1613 Container and Resource Discovery
- T1210 Exploitation of Remote Services
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1529 System Shutdown/Reboot

## Sources

- [Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP (Wiz Research)](https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp)
- [Dirty Frag (CVE-2026-43284 / CVE-2026-43500) — Original DirtyFrag-family disclosure (parent)](https://www.wiz.io/blog/dirty-frag-linux-kernel-privilege-escalation)
- [Linux XFRM subsystem documentation — ESP-in-TCP transport (espintcp)](https://www.kernel.org/doc/html/latest/networking/xfrm_device.html)
- [RFC 8229 — TCP Encapsulation of IKE and IPsec Packets](https://datatracker.ietf.org/doc/html/rfc8229)
- [Linux kernel ESP-in-TCP ULP implementation (net/xfrm/espintcp.c)](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/net/xfrm/espintcp.c)
- [Unprivileged user namespaces — kernel.org admin guide](https://www.kernel.org/doc/html/latest/admin-guide/namespaces/user_namespaces.html)
- [Ubuntu AppArmor restrictions on unprivileged user namespaces](https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces)
- [Linux Kernel splice() / page-fragment skb internals](https://lwn.net/Articles/776487/)
- [Hyunwoo Kim — Researcher profile (Wiz / prior DirtyFrag credit)](https://www.wiz.io/blog/authors/hyunwoo-kim)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0510