Fragnesia vulnerability in Linux kernel enables local privilege escalation via page cache corruption, granting attackers root access; Affects kernels released before May 13, 2026.

Fragnesia is a significant local privilege escalation vulnerability identified in the Linux kernel, particularly affecting its XFRM ESP-in-TCP subsystem. Discovered by researchers, it allows unprivileged local attackers to exploit page cache corruption and gain root privileges, posing serious security risks.

The flaw stems from a logic bug allowing unauthorized modifications in the kernel page cache of read-only files. By strategically writing arbitrary bytes, attackers can manipulate file contents and execute malicious code as root. A proof-of-concept (PoC) exploit demonstrated this, showing how corruption of the /usr/bin/su binary can result in elevated privileges.

The vulnerability emerged as an unintended consequence of patches addressing previous vulnerabilities like Dirty Frag, indicating the complexity of kernel security. As highlighted by the U.S. cybersecurity agency, this type of flaw is a recurrent attack vector, endangering federal infrastructures.

Linux users are urged to apply kernel updates promptly to protect against potential exploits and consider disabling vulnerable modules until patches are fully deployed. Meanwhile, certain restrictions, such as those enabled through AppArmor on unprivileged user namespaces, may offer partial mitigation.

A newly discovered vulnerability in the Linux kernel, dubbed Fragnesia, enables local privilege escalation through page cache corruption, granting unprivileged attackers root access. This flaw affects all kernels released prior to May 13, 2026, prompting urgent patch deployments across various Linux distributions.