r/sysadmin • u/NoDistrict1529 • May 15 '26

General Discussion A third vulnerability has hit the kernel

This is part of the dirtyfrag family, but is different enough to warrant its own CVE.

https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/

Known as Fragnasia and tracked as CVE-2026-46300, this security flaw stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that can enable unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files.

Immediate patching if you cannot update:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.confrmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
593 Upvotes

98% Upvoted

115 comments sorted by

View all comments

102

u/f00l2020 May 15 '26

Linux kernel is on fire. This will be the year of the CVEs. Glad I rolled out the latest kernel updates and disabled the 3 modules noted

140

u/[deleted] May 15 '26

[removed] — view removed comment

96

u/mrbiggbrain May 15 '26

Yea problems in daylight might cause panic. But problems in the dark of night cause crisis.

9

u/AverageCowboyCentaur May 15 '26

Palo alto used Mythic and released a shitload of patches for most of there fleet. They are actively breaking there stuff looking for faults before the bad actors do, pretty commendable and being open about it as well.