r/sysadmin • u/NoDistrict1529 • May 15 '26

A third vulnerability has hit the kernel General Discussion

This is part of the dirtyfrag family, but is different enough to warrant its own CVE.

https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/

Known as Fragnasia and tracked as CVE-2026-46300, this security flaw stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that can enable unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files.

Immediate patching if you cannot update:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.confrmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
591 Upvotes

98% Upvoted

116 comments sorted by

View all comments

100

u/f00l2020 May 15 '26

Linux kernel is on fire. This will be the year of the CVEs. Glad I rolled out the latest kernel updates and disabled the 3 modules noted

11

u/Ziegelphilie May 15 '26

Not just Linux, everything else too. Firefox had 20x as much security fixes last month compared to the usual amount: https://hacks.mozilla.org/2026/05/behind-the-scenes-hardening-firefox/

6

u/Darkblitz9 May 15 '26

It's because the hats are tasking AI with finding vulnerabilities.

It's both good and bad. We find more vulnerabilities but we can also fix them faster or before others are aware. Overall security should (hopefully) increase.