# Another Vulunerabilty found in Kernel: "Fragnesia" a variant of Dirty Frag vulnerability in the ESP/XFRM **URL:** \ **Category:** Linux lounge\ **Created:** [May 14, 2026, 6:13am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654 "2026-05-14T06:13:57Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![ajgringo619](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/ajgringo619/32/35599_2.png) [@ajgringo619](https://forum.endeavouros.com/u/ajgringo619)\ **Post date:** [May 13, 2026, 7:08pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/1 "2026-05-13T19:08:51Z")
(From the Manjaro forums) > **[\[ALERT\] CopyFail 3.0 - Fragnesia - Unpatched vulnerability](https://forum.manjaro.org/t/alert-copyfail-3-0-fragnesia-unpatched-vulnerability/187646)** > > Fragnesia is a universal Linux local privilege escalation exploit, discovered with V12 by William Bowling with the V12 team. Fragnesia is a member of the Dirty Frag vulnerability class. This is a separate bug in the ESP/XFRM from dirtyfrag which... ---
**Author:** ![r0ckhopper](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/r0ckhopper/32/51768_2.png) [@r0ckhopper](https://forum.endeavouros.com/u/r0ckhopper)\ **Post date:** [May 13, 2026, 7:19pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/2 "2026-05-13T19:19:44Z")
> **[bad things come in threes - Wiktionary, the free dictionary](https://en.wiktionary.org/wiki/bad_things_come_in_threes)** ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 14, 2026, 6:13am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/3 "2026-05-14T06:13:57Z")
Thanks to @dirn to [point this out](https://forum.endeavouros.com/t/copy-fail-high-severity-vulnerability-cve-2026-31431/79381/41). “[Fragnesia](https://github.com/v12-security/pocs/tree/main/fragnesia)” is a variant of Dirty Frag vulnerability in the ESP/XFRM. CVE-2026-46300 is the id used to track this. How this functions is > [@](#): > > It writes a small position-independent ELF stub (setresuid/setresgid/execve /bin/sh) over the first 192 bytes of /usr/bin/su in the page cache, then calls execve(“/usr/bin/su”) to obtain a root shell. The page cache modification is not backed to disk; the on-disk binary is untouched. So it takes `/usr/bin/su` in RAM, Modifies its first 192 bytes, executes it and gets privilege escalation. Since the file, `/usr/bin/su`, on the disk is not modified, all of this happens in RAM, an Host based file system monitoring solution will not catch the exploit. This exploit uses page-cache corruption vulnerability. It does not require user interaction, so without user doing anything this can be triggered from a service or from a timer or from any thing else. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 14, 2026, 6:27am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/4 "2026-05-14T06:27:34Z")
The mitigation for this remains the same as that for dirty-frag. Stop the loading of ESP4, ESP6 and XFRM modules. Put the following in the directory `/etc/modprobe.d/` inside a `.conf` file. ```auto install esp4 /bin/false install esp6 /bin/false install rxrpc /bin/false blacklist esp4 blacklist esp6 blacklist rxrpc ``` I wonder if this has been patched or not. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 14, 2026, 7:14am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/5 "2026-05-14T07:14:03Z")
From the [OSS-mailing list](https://www.openwall.com/lists/oss-security/2026/05/13/6), > [@](#): > > This vulnerability is a path that was accidentally activated _after_ the introduction of f4c50a4034e6 (2026-05-05), the patch for CVE-2026-43284 in the Dirty Frag chain. Does this mean that Fragnesia was accidentally activated because of the fix for the Dirty-Frag, i.e. CVE-2026-43284? Or am I misunderstanding this? Continuing in the same email-chain > [@](#): > > Exploitation requires the attacker to have permission to create user namespaces, unless chained with a separate vulnerability. So disabling username space will mitigate the attack vector? It is time for a bottom up re-write of namespaces in Linux Kernel. And it is also time for Firefox and other apps to stop using namespaces. From the same email-chain > [@](#): > > At least for the time being, I recommend keeping the Dirty Frag mitigation in place: So despite dirty-frag being fixed should the mitigation remain in place. The folks at VPN Service providers are not going to be happy. 😆 Some kernel developers are [getting annoyed](https://www.openwall.com/lists/oss-security/2026/05/14/2) > [@](#): > > I understand that the realistic utility of embargoes is currently shrinking dramatically, but this “drop it while it’s hot” approach to seemingly promote yet another AI vulnerability discovery service is a trend I can’t abide. ---
**Author:** ![SCORPION2000](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/scorpion2000/32/39398_2.png) [@SCORPION2000](https://forum.endeavouros.com/u/SCORPION2000)\ **Post date:** [May 14, 2026, 2:05pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/6 "2026-05-14T14:05:42Z")
Wow Microsoft(and others I’m sure) is pushing hard in Linux smear campaign 😬 This and all does DoS attacks 😨. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 14, 2026, 2:26pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/7 "2026-05-14T14:26:59Z")
Well the question still stands. Has this been patched? Does the `dirty-frag` vulnerability fix also patch this up? Or do we have to wait for another Linux Kernel update? ---
**Author:** ![MyNameIsRichard](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/mynameisrichard/32/111876_2.png) [@MyNameIsRichard](https://forum.endeavouros.com/u/MyNameIsRichard)\ **Post date:** [May 14, 2026, 2:30pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/8 "2026-05-14T14:30:27Z")
It looks like it hasn’t been patched yet, because they’re not following responsible disclosure of waiting 90 days. They must really be desperate. ---
**Author:** ![Bink](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/bink/32/87216_2.png) [@Bink](https://forum.endeavouros.com/u/Bink)\ **Post date:** [May 14, 2026, 2:39pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/9 "2026-05-14T14:39:39Z")
The mitigation for Fragnesia appears to be the same as that for Dirty Frag. > [@Another vulnerability that gives root access: dirty-frag (FIXED with Linux kernel 7.0.5 Update)](https://forum.endeavouros.com/t/another-vulnerability-that-gives-root-access-dirty-frag-fixed-with-linux-kernel-7-0-5-update/79530/3): > > This is the mitigation being shared by most sources: Mitigation Because the responsible disclosure schedule and the embargo have been broken, no patch exists for any distribution. Use the following command to remove the modules in which the vulnerabilities occur. sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' \> /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2\>/dev/null; true" Once each distribution backports a patch, update accordingly. … If you’re not needing IPSec (sorry @Archie1 ), or using the Andrew File System (AFS), I suspect you could simply leave these modules disabled… ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 14, 2026, 2:41pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/10 "2026-05-14T14:41:17Z")
> but this “drop it while it’s hot” approach to seemingly promote yet another AI vulnerability discovery service is a trend I can’t abide. Oh I dont envy being in Linux Kernel developer shoes. Windows and Mac OSX gets a pass since they have closed source code. So no one is aware of the vulnerabilities that are there inside Windows. 😆 ---
**Author:** ![ExDebianuser](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/exdebianuser/32/13699_2.png) [@ExDebianuser](https://forum.endeavouros.com/u/ExDebianuser)\ **Post date:** [May 14, 2026, 3:33pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/11 "2026-05-14T15:33:40Z")
I just added this to my blacklist.conf… ---
**Author:** ![Scotty\_Trees](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/scotty_trees/32/29792_2.png) [@Scotty\_Trees](https://forum.endeavouros.com/u/Scotty_Trees)\ **Post date:** [May 14, 2026, 6:21pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/12 "2026-05-14T18:21:06Z")
I’ll just wait for a new kernel update just like the last couple times this happened. ---
**Author:** ![autofire](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/autofire/32/49616_2.png) [@autofire](https://forum.endeavouros.com/u/autofire)\ **Post date:** [May 14, 2026, 11:52pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/13 "2026-05-14T23:52:30Z")
New kernel 7.0.7 just dropped; might be a Fragnesia fix, but it broke my laptop’s internal bluetooth. ---
**Author:** ![drunkenvicar](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/drunkenvicar/32/112222_2.png) [@drunkenvicar](https://forum.endeavouros.com/u/drunkenvicar)\ **Post date:** [May 15, 2026, 12:08am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/14 "2026-05-15T00:08:51Z")
these bug names lately have been hot and sexy. Just sayin. ---
**Author:** ![rich52](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@rich52](https://forum.endeavouros.com/u/rich52)\ **Post date:** [May 15, 2026, 12:40am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/15 "2026-05-15T00:40:29Z")
Just installed 7.0.7 kernel. . . . I’ll have to check and see if my bluethooth is still working. . . Rich 😉 ---
**Author:** ![Scotty\_Trees](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/scotty_trees/32/29792_2.png) [@Scotty\_Trees](https://forum.endeavouros.com/u/Scotty_Trees)\ **Post date:** [May 15, 2026, 2:56am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/16 "2026-05-15T02:56:49Z")
@autofire @rich52 Just booted up 7.0.7 and bluetooth is still working on my Acer laptop. ---
**Author:** ![rich52](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/r/ecb155/32.png) [@rich52](https://forum.endeavouros.com/u/rich52)\ **Post date:** [May 15, 2026, 5:40pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/17 "2026-05-15T17:40:42Z")
I’ve gone through the bluetooth help in the ‘Welcome’ app. I’ve gotten my ‘Smokin Buds’ to work a few times in the past but more often than not they disconnect or can’t be found again during pairing. Right now I have conflicts with the bluetooth being ‘enabled’ and ‘not enabled’ in several different place locations in the KDE plasma software. This is particularly strange in my opinion. In some area’s it is enabled and others not enabled. . . . It’s pretty much screwed up. When these earphones worked in the past they were great and worked like a charm . . . .now they don’t work once again. I’m currently running kernel 7.0.7 - 2-1 arch. Rich 😉 ---
**Author:** ![autofire](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/autofire/32/49616_2.png) [@autofire](https://forum.endeavouros.com/u/autofire)\ **Post date:** [May 15, 2026, 7:43pm UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/18 "2026-05-15T19:43:54Z")
Who made your laptop’s bluetooth module? Mine is from Mediatek, and I did see that 7.0.7 touched Mediatek bluetooth driver code… ---
**Author:** ![HBR](https://forum.endeavouros.com/letter_avatar_proxy/v4/letter/h/8edcca/32.png) [@HBR](https://forum.endeavouros.com/u/HBR)\ **Post date:** [May 16, 2026, 5:56am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/19 "2026-05-16T05:56:38Z")
7.0.8.arch1-1 / 7.0.8-zen1-1-zen fixes this for Mediatek BT. Arch mainterners picked a pending patch from upstream. ---
**Author:** ![Archie1](https://forum.endeavouros.com/user_avatar/forum.endeavouros.com/archie1/32/111095_2.png) [@Archie1](https://forum.endeavouros.com/u/Archie1)\ **Post date:** [May 16, 2026, 7:03am UTC](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654/20 "2026-05-16T07:03:03Z")
Why is a fix for Fragnesia and dirty-frag updating code of Bluetooth? Or did the Bluetooth code just hop a ride with this fix. [Next page](https://forum.endeavouros.com/t/another-vulunerabilty-found-in-kernel-fragnesia-a-variant-of-dirty-frag-vulnerability-in-the-esp-xfrm/79654.md?page=2)