A fourth vulnerability has been identified in the Linux kernel in the last two weeks (CVE-2026-46300), allowing an unprivileged user to gain root rights by overwriting data in the page cache. The vulnerability has been given the code name Fragnesia or Copy Fail 3.0. The essence of the vulnerability is similar to previously disclosed vulnerabilities Copy Fail and Dirty Frag. Like Dirty Frag, the new vulnerability is present in the xfrm-ESP subsystem but is caused by a different error and requires a separate fix. An exploit is available.
The vulnerability manifests in Linux kernels released after May 5, due to its accidental activation by the fix for the Dirty Frag vulnerability. A fix has been proposed for the Fragnesia vulnerability in the Linux kernel. Analysis of this fix showed that it was insufficient, leading to the preparation of a second patch.
The vulnerability is present in the xfrm subsystem in the implementation of the encapsulating security payload (ESP) protocol in TCP (ESP-in-TCP, RFC 8229), used for tunneling IPsec traffic over TCP. To eliminate unnecessary buffering, operations using the AES-GCM algorithm were performed in place by executing an XOR operation on the data in the page cache. Due to a logical error, conditions arose that allowed overwriting 1 byte in the page cache at a chosen offset. By repeating operations, it is possible to modify the content of any file in the page cache byte by byte.
All file read operations first return content from the page cache. If data in the page cache is modified, file read operations will return not the information actually stored on the storage device, but altered data. Exploitation of the vulnerability boils down to changing the page cache for an executable file with the suid root flag, which was previously read to enter the page cache. In the exploit proposed by researchers, the first 192 bytes of the file /usr/bin/su in the page cache are overwritten with code to launch /usr/bin/sh. A subsequent invocation of the 'su' utility will load not the original executable file from the storage device, but the modified copy from the page cache.
For the Fragnesia vulnerability to be exploitable, user namespace creation must be allowed in the system. In Ubuntu, this operation is disabled by default, but can be enabled through the sysctl 'kernel.apparmor_restrict_unprivileged_userns=0' or AppArmor profiles. In other distributions, the availability of the user namespace for unprivileged users depends on setting the sysctl 'kernel.unprivileged_userns_clone' (if 0, it is prohibited).
Updates with fixes for the Linux kernel and kernel packages in distributions have not yet been released. The status of vulnerability mitigation in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE/openSUSE, RHEL, Gentoo, Arch, Fedora. As a workaround for protection, the loading of kernel modules esp4 and esp6 can be blocked:
sh -c 'printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 2>/dev/null; true'
Source: opennet.ru
