Fragnesia-go

fragnesia-go One SA. One byte at a time. No race. Go port of fragnesia CVE-2026-46300. Member of the Dirty Frag vulnerability class - separate bug, same surface, own patch. How it works tl;dr The bug is in the Linux XFRM ESP-in-TCP subsystem. When TCPULP espintcp is installed on a socket after da...

CVE-2026-46300

🛡️ CVE-2026-46300 - Fragnesia 一种干净而致命的页面缓存攻击 "Dirty Frag"家族的一个变种 📌 概述 CVE-2026-46300 （Fragnesia）是 Linux 内核在 XFRM/ESP-in-TCP 子系统（espintcp ULP）中 socket 缓冲区处理（skbtrycoalesce）的一个 高严重性逻辑缺陷 。 无特权的本地攻击者 可以对任何 可读 文件（包括 /usr/bin/su 等系统二进制文件）的内核页面缓存实现 任意字节写入 ，从而导致可靠的 本地权限提升为 root 。 ✨ 主要亮点 ✅ 无需竞争条件 ✅ 完全作用于...

CVE-2026-80846

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

CVE-2026-80846 xfrm: drop ESP-in-TCP packets with no ingress device

In the Linux kernel, the following vulnerability has been resolved: xfrm: drop ESP-in-TCP packets with no ingress device ESP-in-TCP receives records through the TCP strparser. handleesp restores skb-dev from the saved skbiif before passing the packet into the XFRM input path. Queued TCP data can ...

USN-8548-2: Linux kernel vulnerabilities

It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container. CVE-2026-43503 Several security issues...

USN-8530-2 linux-aws-hwe vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...

USN-8530-2: Linux kernel (HWE) vulnerabilities

It was discovered that the Linux kernel did not properly handle shared page fragments during socket buffer operations, collectively known as Dirty Frag. A logic flaw existed in the XFRM ESP-in-TCP subsystem and in the RxRPC networking subsystem when processing paged fragments. A local attacker...