{"id":170701,"date":"2026-05-15T12:24:29","date_gmt":"2026-05-15T10:24:29","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha"},"modified":"2026-05-15T12:24:29","modified_gmt":"2026-05-15T10:24:29","slug":"fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/fragnesia-uyazvimost-v-yadre-linux-pozvolyayushhaya-poluchit-root-cherez-izmenenie-stranichnogo-kesha","title":{"rendered":"Fragnesia \u2014 a vulnerability in the Linux kernel that allows root access through page cache modification","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A fourth vulnerability has been identified in the Linux kernel in the last two weeks (CVE-2026-46300), allowing an unprivileged user to gain root rights by overwriting data in the page cache. The vulnerability has been given the code name Fragnesia or Copy Fail 3.0. The essence of the vulnerability is similar to previously disclosed vulnerabilities Copy Fail and Dirty Frag. Like Dirty Frag, the new vulnerability is present in the xfrm-ESP subsystem but is caused by a different error and requires a separate fix. An exploit is available. <\/p>\n
The vulnerability manifests in Linux kernels released after May 5, due to its accidental activation by the fix for the Dirty Frag vulnerability. A fix has been proposed for the Fragnesia vulnerability in the Linux kernel. Analysis of this fix showed that it was insufficient, leading to the preparation of a second patch. <\/p>\n
The vulnerability is present in the xfrm subsystem in the implementation of the encapsulating security payload (ESP) protocol in TCP (ESP-in-TCP, RFC 8229), used for tunneling IPsec traffic over TCP. To eliminate unnecessary buffering, operations using the AES-GCM algorithm were performed in place by executing an XOR operation on the data in the page cache. Due to a logical error, conditions arose that allowed overwriting 1 byte in the page cache at a chosen offset. By repeating operations, it is possible to modify the content of any file in the page cache byte by byte. <\/p>\n
All read operations from files first retrieve content from the page cache. If the data in the page cache is modified, reading from the file will return not the information actually stored on the disk, but altered data. Exploiting the vulnerability involves changing the page cache for an executable file with the suid root flag, which has previously been read to reach the page cache. In the exploit proposed by the researchers, the first 192 bytes of the file \/usr\/bin\/su in the page cache are overwritten with code to execute \/usr\/bin\/sh. When the 'su' utility is subsequently run, a modified copy from the page cache will be loaded into memory instead of the original executable file from the storage. <\/p>\n
To exploit the Fragnesia vulnerability, the creation of user namespaces must be allowed in the system. In Ubuntu, this operation is disabled by default but can be enabled via sysctl 'kernel.apparmor_restrict_unprivileged_userns=0' or AppArmor profiles. In other distributions, the availability of 'user namespace' to unprivileged users depends on setting sysctl 'kernel.unprivileged_userns_clone' (if 0, it is prohibited). <\/p>\n
Updates with fixes for the Linux kernel and kernel packages in distributions have not yet been released. The status of vulnerability mitigation in distributions can be assessed on the following pages: Debian, Ubuntu, SUSE\/openSUSE, RHEL, Gentoo, Arch, Fedora. As a workaround for protection, the loading of kernel modules esp4 and esp6 can be blocked: <\/p>\n