{"id":170863,"date":"2026-05-18T12:24:54","date_gmt":"2026-05-18T10:24:54","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root"},"modified":"2026-05-18T12:24:54","modified_gmt":"2026-05-18T10:24:54","slug":"v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","title":{"rendered":"A Linux-en felt\u00e1rt\u00e1k a Fragnesia nev\u0171 \u00faj LPE-sebezhet\u0151s\u00e9get, amely lehet\u0151v\u00e9 teszi, hogy egy helyi felhaszn\u00e1l\u00f3 root jogosults\u00e1gokat szerezzen.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

A Linux kernel vulnerability has been revealed, known as Fragnesia<\/strong> and identifier CVE-2026-46300<\/strong>. The problem relates to the same class of page cache attacks as the recently discussed Copy Fail and Dirty Frag, but it is not a re-publication of an old error: it refers to a distinct defect in the code of XFRM ESP-in-TCP<\/strong>.<\/p>\n

. The vulnerability was discovered by researcher William Bowling<\/strong> from the team V12 Security<\/strong>. According to the published description, Fragnesia allows an unprivileged local user to modify the contents of read-only files in the page cache memory and, as a result, execute code with root privileges. Unlike many old LPE exploits, the attack does not require a race condition and is described by researchers as deterministic.<\/p>\n

Technically, the problem is related to the fact that when network buffers are merged, the kernel may lose track of whether a data fragment is 'shared' and associated with an external memory page, including the page cache. The proposed patch describes this as an error in skb_try_coalesce(): when transferring paged fragments from one sk_buff to another, the SKBFL_SHARED_FRAG flag was not preserved. As a result, later ESP code might mistakenly consider the buffer safe for modification.<\/p>\n

The practical effect is that data previously placed in the TCP queue from a file, after switching the socket to the espintcp mode, could be processed by the kernel as ESP ciphertext. When decrypted with AES-GCM, bytes were modified directly in the page cache page associated with the file. This does not change the file on disk, but alters its representation in memory until the page is evicted from the cache.<\/p>\n

In the published attack demonstration, the target was \/usr\/bin\/su: the exploit modified the initial bytes of the binary file in the page cache and then executed the modified in-memory copy, obtaining a shell with root privileges. The original file on disk remained unchanged, making the issue particularly unpleasant for diagnostics: traces of exploitation may disappear after clearing the page cache or rebooting.<\/p>\n

A Fragnesia kevesebb mint egy h\u00e9ttel a Dirty Frag ut\u00e1n jelent meg. A V12 hangs\u00falyozza, hogy ez egy k\u00fcl\u00f6n hiba ugyanazon t\u00e1mad\u00e1si fel\u00fcleten \u2014 ESP\/XFRM \u2014 nem egy m\u00e1r jav\u00edtott s\u00e9r\u00fcl\u00e9kenys\u00e9g \u00e1tnevez\u00e9se. A Phoronix azt is megjegyzi, hogy a publik\u00e1l\u00e1s id\u0151pontj\u00e1ban el\u00e9rhet\u0151 volt egy proof-of-concept, a jav\u00edt\u00e1s pedig egy kis patch volt a net\/core\/skbuff.c f\u00e1jlhoz, amely m\u00e9g nem ker\u00fclt az alap\u00e9rtelmezett kernelvekbe.<\/p>\n

<\/p>\n

A Canonical CVE-2026-46300<\/a> magas priorit\u00e1st adott az Ubuntu sz\u00e1m\u00e1ra, megjel\u00f6lve az okot mint \"trivi\u00e1lis helyi jogosults\u00e1g-emelked\u00e9s\". Az Ubuntu Security oldal\u00e1n a friss\u00edt\u00e9s id\u0151pontj\u00e1ban a s\u00e9rintett kernelvek st\u00e1tusza \"\u00c9rt\u00e9kel\u00e9s sz\u00fcks\u00e9ges\" volt, \u00e9s a megjegyz\u00e9sben k\u00fcl\u00f6n eml\u00edtik, hogy a probl\u00e9ma szint\u00e9n tal\u00e1lhat\u00f3 az ESP modulban \u00e9s \u00e1tmenetileg azonos m\u00f3don lehet m\u00e9rs\u00e9kelni, mint a Dirty Frag eset\u00e9ben.<\/p>\n

<\/noindex><\/noindex> <\/p>\n

Debian Security Tracker<\/a> a vizsg\u00e1lat id\u0151pontj\u00e1ban jel\u00f6lte meg s\u00e9r\u00fcl\u00e9kenynek a bullseye, bookworm, trixie, forky \u00e9s sid \u00e1gtartom\u00e1nyok kerneljeit; a linux csomag instabil v\u00e1ltozat\u00e1hoz m\u00e9g nem volt megadva a kijav\u00edtott verzi\u00f3.<\/p>\n

<\/noindex> <\/p>\n

A v\u00e9delmi id\u0151szakos int\u00e9zked\u00e9s ugyanaz marad, mint a Dirty Frag eset\u00e9ben: a modulok bet\u00f6lt\u00e9s\u00e9nek letilt\u00e1sa<\/a> esp4, esp6 \u00e9s rxrpc, ha a rendszernek nincs sz\u00fcks\u00e9ge r\u00e1juk. Ez megszak\u00edthatja az IPsec alagutakat azon csom\u00f3pontokon, ahol kernel ESP, strongSwan, Libreswan vagy hasonl\u00f3 konfigur\u00e1ci\u00f3k haszn\u00e1latosak, ez\u00e9rt VPN-hidakon ezt az int\u00e9zked\u00e9st csak a k\u00f6vetkezm\u00e9nyek felm\u00e9r\u00e9se ut\u00e1n \u00e9rdemes alkalmazni.<\/p>\n

<\/noindex> <\/p>\n

P\u00e9lda a vezet\u0151k sz\u00e1m\u00e1ra az \u00e1tmeneti m\u00e9rs\u00e9kl\u00e9sre:<\/p>\n

sudo sh -c \"printf 'install esp4 \/bin\/falseninstall esp6 \/bin\/falseninstall rxrpc \/bin\/falsen' > \/etc\/modprobe.d\/dirtyfrag.conf\" sudo rmmod esp4 esp6 rxrpc 2>\/dev\/null || true <\/p>\n

Ha gyan\u00edtj\u00e1k, hogy a rendszer m\u00e1r t\u00e1mad\u00e1s alatt \u00e1llt, a modulok blokkol\u00e1sa nem elegend\u0151: mivel a nyilv\u00e1nos demonstr\u00e1ci\u00f3 az executable f\u00e1jlt pontosan a page cache-ben m\u00f3dos\u00edtja, a rendszergazd\u00e1k javasolj\u00e1k a lapk\u00e9szlet t\u00f6rl\u00e9s\u00e9t vagy a rendszer \u00fajraind\u00edt\u00e1s\u00e1t a v\u00e9delmi int\u00e9zked\u00e9sek alkalmaz\u00e1sa ut\u00e1n. A CloudLinux egy\u00e9rtelm\u0171en kijelenti, hogy a kihaszn\u00e1l\u00e1s ut\u00e1n a \/usr\/bin\/su m\u00f3dos\u00edtva maradhat a mem\u00f3ri\u00e1ban, am\u00edg a megfelel\u0151 lapokat ki nem szor\u00edtj\u00e1k.<\/p>\n

A tempor\u00e1lis szab\u00e1ly elt\u00e1vol\u00edt\u00e1s\u00e1hoz a jav\u00edtott kernel telep\u00edt\u00e9se ut\u00e1n elt\u00e1vol\u00edthatja a l\u00e9trehozott f\u00e1jlt:<\/p>\n

sudo rm \/etc\/modprobe.d\/dirtyfrag.conf <\/p>\n

A f\u0151 aj\u00e1nl\u00e1s tov\u00e1bbra is az alap\u00e9rtelmezett: telep\u00edtse a disztrib\u00faci\u00f3j\u00e1t\u00f3l sz\u00e1rmaz\u00f3 jav\u00edtott kernelt, \u00e9s ind\u00edtsa \u00fajra a rendszert. A friss\u00edt\u00e9s el\u0151tt a legnagyobb kock\u00e1zatot a t\u00f6bbfelhaszn\u00e1l\u00f3s szerverek, CI-futtat\u00f3k, megosztott t\u00e1rhely, kont\u00e9neres build-farmok \u00e9s b\u00e1rmely g\u00e9p jelenti, ahol nem privil\u00e9giz\u00e1lt vagy r\u00e9szben megb\u00edzhat\u00f3 felhaszn\u00e1l\u00f3k futtathatnak helyi k\u00f3dot.<\/p>\n

Forr\u00e1s: linux.org.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300. \u041f\u0440\u043e\u0431\u043b\u0435\u043c\u0430 \u043e\u0442\u043d\u043e\u0441\u0438\u0442\u0441\u044f \u043a \u0442\u043e\u043c\u0443 \u0436\u0435 \u043a\u043b\u0430\u0441\u0441\u0443 \u0430\u0442\u0430\u043a \u043d\u0430 page cache, \u0447\u0442\u043e \u0438 \u043d\u0435\u0434\u0430\u0432\u043d\u043e \u043e\u0431\u0441\u0443\u0436\u0434\u0430\u0432\u0448\u0438\u0435\u0441\u044f Copy Fail \u0438 Dirty Frag, \u043d\u043e \u043d\u0435 \u044f\u0432\u043b\u044f\u0435\u0442\u0441\u044f \u043f\u043e\u0432\u0442\u043e\u0440\u043d\u043e\u0439 \u043f\u0443\u0431\u043b\u0438\u043a\u0430\u0446\u0438\u0435\u0439 \u0441\u0442\u0430\u0440\u043e\u0439 \u043e\u0448\u0438\u0431\u043a\u0438: \u0440\u0435\u0447\u044c \u0438\u0434\u0451\u0442 \u043e\u0431 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c \u0434\u0435\u0444\u0435\u043a\u0442\u0435 \u0432 \u043a\u043e\u0434\u0435 XFRM ESP-in-TCP. \u0423\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043e\u0431\u043d\u0430\u0440\u0443\u0436\u0438\u043b \u0438\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u044c William Bowling […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":8,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-170863","post","type-post","status-publish","format-standard","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47A new LPE vulnerability Fragnesia has been discovered in Linux, allowing a local user to gain root access | ProHoster","description":"A Linux kernel vulnerability has been revealed, named Fragnesia with identifier CVE-2026-46300.","canonical_url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"hu_HU","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47\u0412 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043d\u043e\u0432\u0430\u044f LPE-\u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c Fragnesia, \u043f\u043e\u0437\u0432\u043e\u043b\u044f\u044e\u0449\u0430\u044f \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u043c\u0443 \u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u0442\u0435\u043b\u044e \u043f\u043e\u043b\u0443\u0447\u0438\u0442\u044c root | ProHoster","og:description":"\u0412 \u044f\u0434\u0440\u0435 Linux \u0440\u0430\u0441\u043a\u0440\u044b\u0442\u0430 \u043e\u0447\u0435\u0440\u0435\u0434\u043d\u0430\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u044c \u043b\u043e\u043a\u0430\u043b\u044c\u043d\u043e\u0433\u043e \u043f\u043e\u0432\u044b\u0448\u0435\u043d\u0438\u044f \u043f\u0440\u0438\u0432\u0438\u043b\u0435\u0433\u0438\u0439, \u043f\u043e\u043b\u0443\u0447\u0438\u0432\u0448\u0430\u044f \u043d\u0430\u0437\u0432\u0430\u043d\u0438\u0435 Fragnesia \u0438 \u0438\u0434\u0435\u043d\u0442\u0438\u0444\u0438\u043a\u0430\u0442\u043e\u0440 CVE-2026-46300.","og:url":"https:\/\/prohoster.info\/hu\/blog\/news\/v-linux-raskryta-novaya-lpe-uyazvimost-fragnesia-pozvolyayushhaya-lokalnomu-polzovatelyu-poluchit-root","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2026-05-18T10:24:54+00:00","article:modified_time":"2026-05-18T10:24:54+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":[],"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/170863","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/users\/8"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/comments?post=170863"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/posts\/170863\/revisions"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/media?parent=170863"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/categories?post=170863"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/hu\/wp-json\/wp\/v2\/tags?post=170863"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}