Key Takeaways

• Fragnesia is a local privilege‑escalation flaw in the Linux kernel that lets any unprivileged user obtain root without a race condition.
• The bug resides in the XFRM ESP‑in‑TCP Upper Layer Protocol (ULP) handling, where the kernel mistakenly treats spliced file pages as ESP ciphertext.
• By controlling the AES‑GCM nonce, an attacker can XOR‑flip arbitrary bytes in the page cache of a read‑only file (e.g., /usr/bin/su) – one byte per exploit invocation.
• Repeated invocations build a small ELF stub in the page cache that calls setresuid(0,0,0) and spawns a root shell, while the on‑disk binary stays unchanged.
• All kernel versions released before 13 May 2026 are vulnerable; a patch has been submitted upstream.
• Immediate mitigation: unload the ESP modules (esp4, esp6, rxrpc) and block their auto‑loading via /etc/modprobe.d/dirtyfrag.conf.
• After exploitation, the modified page‑cache copy of /usr/bin/su persists until the cache is flushed (echo 1 > /proc/sys/vm/drop_caches) or the system is rebooted.
• A public proof‑of‑concept on GitHub lowers the exploitation barrier, making prompt patching a critical priority for Linux administrators.

Overview of Fragnesia
Fragnesia is a newly disclosed Linux kernel vulnerability that enables any local, unprivileged user to escalate privileges to root without needing a race condition. Discovered by William Bowling of the V12 security team, the flaw belongs to the “Dirty Frag” class of bugs—relatives of the well‑known Dirty Pipe and Copy Fail vulnerabilities—but it targets a distinct logic error in the XFRM ESP‑in‑TCP subsystem. Because the exploit does not rely on timing windows, it is considerably more reliable than many recent local privilege‑escalation bugs.

Discovery and Context
The vulnerability was identified during routine auditing of the kernel’s networking stack, specifically the code that handles Encapsulating Security Payload (ESP) when transported over TCP (ESP‑in‑TCP). Bowling reported the issue to the kernel maintainers, and a patch has since been submitted upstream. Fragnesia joins a growing list of kernel bugs that subtly violate memory‑safety assumptions, demonstrating how seemingly innocuous protocol handling can become a powerful attack vector when mis‑implemented.

Technical Mechanism
At the heart of Fragnesia lies a logic flaw in how the kernel processes ESP‑in‑TCP ULP mode. When a TCP socket transitions to the espintcp ULP after file data has already been spliced into the receive queue, the kernel incorrectly treats those queued file pages as ESP ciphertext. Consequently, a single byte of the AES‑GCM keystream is XORed directly into a read‑only file’s page‑cache entry. No race condition is required; the mistake occurs deterministically each time the kernel performs the coalescing operation.

Because AES‑GCM’s keystream byte is a function of the initialization vector (IV) nonce, an attacker who can influence the nonce value can produce any desired keystream byte. By pre‑computing a 256‑entry lookup table that maps each possible keystream byte to the nonce that yields it, the attacker gains the ability to flip any byte in a cached file to an arbitrary value, one byte per trigger of the vulnerability.

Exploitation Process
The exploit leverages this byte‑wise flip capability to modify the in‑memory page cache of a privileged binary, most commonly /usr/bin/su. The attacker first ensures that the target file is cached (e.g., by executing it once). Then, using the lookup table, they iterate over a malicious payload—an ELF stub that invokes setresuid(0,0,0) followed by execve("/bin/sh", …). Each iteration flips one byte of the cached page‑cache copy of /usr/bin/su toward the stub’s opcode. After 192 successful invocations, the entire stub resides in the page cache, overwriting the original su code while leaving the on‑disk file untouched.

When a user subsequently runs su, the kernel serves the modified page‑cache version, which immediately elevates the process to UID 0 (root) and spawns a root shell. Because the modification lives only in memory, the attack leaves no trace on the filesystem, making forensic detection more challenging.

Post‑Exploitation Effects
A critical side‑effect of Fragnesia is persistence: the altered page‑cache entry for /usr/bin/su remains until the cache is cleared or the system is rebooted. Every subsequent invocation of su will therefore re‑spawn a root shell, giving an attacker long‑term privileged access on the compromised host. Administrators must flush the page cache (echo 1 > /proc/sys/vm/drop_caches) or reboot the machine before considering it safe to leave unattended after an exploitation attempt.

Affected Versions and Mitigation
All Linux kernel releases prior to 13 May 2026 are vulnerable, as the flaw resides in code that has been present since the introduction of ESP‑in‑TCP ULP support. The kernel maintainers have prepared a patch that corrects the erroneous handling of spliced file pages during ULP transition; it has been submitted upstream and is awaiting inclusion in the next stable release.

In the interim, administrators can mitigate the risk by preventing the vulnerable ESP modules from loading:

bash

Unload the modules if they are currently active

sudo modprobe -r esp4 esp6 rxrpc

Create a modprobe configuration to block future loads

sudo tee /etc/modprobe.d/dirtyfrag.conf <<‘EOF’
install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
EOF

These steps ensure that the kernel cannot invoke the faulty code path, effectively neutralizing Fragnesia until a patched kernel can be deployed.

Proof‑of‑Concept and Recommendations
A public proof‑of‑concept (PoC) exploiting Fragnesia has already been published on GitHub, significantly lowering the barrier for attackers. The PoC automates the creation of the nonce lookup table, the repeated byte‑flipping loop, and the final execution of the root shell. Organizations running Linux servers—especially those exposing local user accounts (e.g., multi‑tenant systems, containers with privileged users, or development workstations)—should treat this vulnerability as critical.

The recommended course of action is threefold:

1. Apply the upstream patch as soon as it appears in your distribution’s kernel updates.
2. Implement the module‑blocking mitigation immediately on any unpatched systems.
3. Flush the page cache or reboot any host where the exploit may have been executed, and audit logs for unexpected su invocations to detect possible compromise.

Conclusion
Fragnesia exemplifies how a subtle logic error in kernel networking code can be transformed into a reliable, race‑condition‑free local privilege‑escalation exploit. Its ability to modify privileged binaries solely through the page cache, without touching the underlying disk, makes it both stealthy and persistent. Prompt patching, coupled with proactive module restrictions and cache hygiene, is essential to safeguard Linux environments against this threat. By understanding the vulnerability’s mechanism and applying the mitigations outlined above, administrators can significantly reduce the risk of unauthorized root access stemming from Fragnesia.