Another Vulunerabilty found in Kernel: "Fragnesia" a variant of Dirty Frag vulnerability in the ESP/XFRM

[Archie1]

Thanks to @dirn to point this out.

“Fragnesia” is a variant of Dirty Frag vulnerability in the ESP/XFRM. CVE-2026-46300 is the id used to track this. How this functions is

It writes a small position-independent ELF stub (setresuid/setresgid/execve /bin/sh) over the first 192 bytes of /usr/bin/su in the page cache, then calls execve(“/usr/bin/su”) to obtain a root shell. The page cache modification is not backed to disk; the on-disk binary is untouched.

So it takes /usr/bin/su in RAM, Modifies its first 192 bytes, executes it and gets privilege escalation. Since the file, /usr/bin/su, on the disk is not modified, all of this happens in RAM, an Host based file system monitoring solution will not catch the exploit. This exploit uses page-cache corruption vulnerability.

It does not require user interaction, so without user doing anything this can be triggered from a service or from a timer or from any thing else.