Fragnesia: Local Linux kernel flaw lets unprivileged users gain root access
Security researchers disclosed Fragnesia, a local privilege-escalation vulnerability in the Linux kernel (Dirtyfrag family) that lets an unprivileged user escalate to root by abusing ESP-in-TCP ULP handling and corrupting the kernel page cache, effectively enabling an in-memory overwrite of /usr/bin/su to spawn a root shell without altering on-disk binaries. The flaw affects virtually all kernels affected by Dirtyfrag up to May 13, 2026; upstream patches exist, but unpatched systems remain at risk. Mitigations include unloading/disabling the affected ESP modules (esp4, esp6, rxrpc) via a dirtyfrag.conf and flushing caches or rebooting to drop the modified page cache. A public PoC on GitHub lowers the barrier to exploitation, so applying the patch promptly is critical.
- Fragnesia Linux Vulnerability Let Attackers Gain Root Privileges – PoC Released CyberSecurityNews
- Active attack: Dirty Frag Linux vulnerability expands post-compromise risk Microsoft
- Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP wiz.io
- 'Dirty Frag' Exploit Poised to Blow Up on Enterprise Linux Distros Dark Reading
- Linux bitten by second severe vulnerability in as many weeks Ars Technica
Reading Insights
0
5
57 min
vs 58 min read
99%
11,447 → 113 words
Want the full story? Read the original article
Read on CyberSecurityNews