Linux kernel skbuff shared-frag marker loss enabling ESP page-cache corruption

CVE-2026-46300, nicknamed Fragnesia, is a logic flaw in the Linux kernel's skb_try_coalesce() path. When TCP receive coalescing moves paged fragments between socket buffers, the SKBFL_SHARED_FRAG marker is dropped. ESP input then sees skb_has_shared_frag() as false on the merged buffer, decides the nonlinear skb can skip skb_cow_data(), and decrypts in place directly over page-cache-backed fragments. An unprivileged local attacker exploits this by creating user and network namespaces to gain CAP_NET_ADMIN, installing an AES-128-GCM transport-mode ESP security association over TCP, splicing a target read-only file's pages into the receive queue, and then enabling the espintcp ULP. The kernel treats the queued file pages as ESP ciphertext and XORs its keystream into the cached pages — one byte at a time with a precomputed nonce-to-byte lookup table — overwriting the page-cache copy of any file, including setuid-root binaries like /usr/bin/su. The flaw was introduced in kernel 3.9 (2013) and affects every unpatched branch including stable series 5.10, 5.15, 6.1, 6.6, 6.12, and mainline 7.x. Fixed upstream in 5.10.257, 5.15.208, 6.1.174, 6.6.141, and 6.12.90. Discoverer: William Bowling (Zellic / V12 Security), disclosed May 13, 2026 without prior vendor coordination.

The vendor CVSS score of 7.8 HIGH (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) is reasonable as a base measurement but undersells the operational risk. The 7.8 correctly captures the local-access prerequisite and the full CIA impact. What it fails to account for is the *reliability* of the primitive (deterministic, no race, byte-at-a-time writes), the *breadth* of the attack surface (every Linux kernel for 13 years), the *weaponization state* (Metasploit module shipping, multiple public PoCs, KEV-listed), and the *deployment-role blast radius* (container hosts, hypervisors, CI runners, database tiers — where local root means fleet-scale or supply-chain-scale impact). noisgate upgrades this to 8.2 HIGH to reflect the exploitation reality while respecting the local-access gate that prevents CRITICAL.

Bottom line: Under the noisgate mitigation SLA, HIGH severity mandates compensating controls within 30 days and full remediation (vendor patch) within 180 days. However, because this CVE is KEV-listed with active exploitation, the mitigation SLA is overridden: deploy the ESP module blacklist or namespace restriction immediately, within hours, then schedule kernel patching within your standard change window. For RHEL, Debian, Ubuntu, SUSE, and Amazon Linux, patched kernels are already available. If you run IPsec VPNs, prefer the namespace restriction (Option 1) to avoid breaking tunnels. Verify every host with the detection script below — the exploit leaves no on-disk artifacts, so sha256sum /usr/bin/su before and after a page-cache drop is your only post-exploitation indicator.

Sources.

1. Debian Security Tracker — CVE-2026-46300
2. Picus Security — Fragnesia CVE-2026-46300 Explained
3. BleepingComputer — Fragnesia Linux Flaw
4. Qualys ThreatPROTECT — CVE-2026-46300
5. CIQ — Fragnesia Mitigation on Rocky Linux
6. Kernel upstream fix commit
7. Rapid7 Metasploit Module
8. Rapid7 Release Notes — Metasploit 5.1.0-2026073001

Run as root on each target Linux host: sudo bash check_cve_2026_46300.sh. Root is needed to probe module loading and sysctl values. The script checks the running kernel against known fixed stable branches, verifies ESP module blacklisting, checks namespace restrictions, and prints PATCHED, VULNERABLE, or UNKNOWN. For RHEL/CentOS with backported kernels (e.g., 4.18.x, 5.14.x), the script will print UNKNOWN — check your vendor advisory directly.

#!/usr/bin/env bash\nset -euo pipefail\n# CVE-2026-46300 (Fragnesia) vulnerability checker\n# Exit: 0=PATCHED 1=VULNERABLE 2=UNKNOWN\nR=UNKNOWN\nK=$(uname -r)\necho "Kernel: $K"\nIFS='.-' read -r A B C _ <<< "$K"\nBR=$A.$B\ncase $BR in\n  5.10) F=257;; 5.15) F=208;; 6.1) F=174;;\n  6.6) F=141;; 6.12) F=90;; 7.0) F=6;; *) F=;;\nesac\nif [ -n "$F" ]; then\n  if [ "$C" -ge "$F" ] 2>/dev/null; then\n    echo "[PATCHED] kernel $BR.$C >= $BR.$F"; R=PATCHED\n  else\n    echo "[VULN] kernel $BR.$C < $BR.$F"; R=VULNERABLE\n  fi\nelse\n  echo "[INFO] branch $BR not in fixed-version map -- check vendor advisory"\nfi\n# ESP module mitigation check\nEB=true\nfor m in esp4 esp6; do\n  if modprobe -n -v $m 2>/dev/null | grep -q /bin/false; then\n    echo "[OK] $m blacklisted"\n  elif lsmod | grep -qw $m 2>/dev/null; then\n    echo "[EXPOSED] $m loaded"; EB=false\n  else\n    echo "[OK] $m not loaded"\n  fi\ndone\n# Namespace sysctl check\nUN=$(sysctl -n user.max_user_namespaces 2>/dev/null || echo '?')\nNN=$(sysctl -n user.max_net_namespaces 2>/dev/null || echo '?')\nNS=false\nif [ "$UN" = 0 ] || [ "$NN" = 0 ]; then\n  echo "[OK] namespaces restricted (user=$UN net=$NN)"; NS=true\nelse\n  echo "[EXPOSED] namespaces open (user=$UN net=$NN)"\nfi\n# Override vulnerable verdict if mitigations are active\nif [ "$R" = VULNERABLE ]; then\n  if $EB; then echo "[MITIGATED] ESP modules blocked"; R=PATCHED; fi\n  if $NS; then echo "[MITIGATED] namespaces restricted"; R=PATCHED; fi\nfi\n# Page-cache integrity spot-check\nif [ -f /usr/bin/su ] && command -v sha256sum >/dev/null 2>&1; then\n  H1=$(sha256sum /usr/bin/su | awk '{print $1}')\n  sysctl -w vm.drop_caches=1 >/dev/null 2>&1 || true\n  H2=$(sha256sum /usr/bin/su | awk '{print $1}')\n  if [ "$H1" != "$H2" ]; then\n    echo "[ALERT] /usr/bin/su page-cache differs from disk -- POSSIBLE EXPLOITATION"\n    R=VULNERABLE\n  else\n    echo "[OK] /usr/bin/su page-cache matches disk"\n  fi\nfi\necho "---"\necho "$R"\ncase $R in PATCHED) exit 0;; VULNERABLE) exit 1;; *) exit 2;; esac