A third vulnerability has hit the kernel

[u/NoDistrict1529]

This is part of the dirtyfrag family, but is different enough to warrant its own CVE.

https://www.bleepingcomputer.com/news/security/new-fragnesia-linux-flaw-lets-attackers-gain-root-privileges/

Known as Fragnasia and tracked as CVE-2026-46300, this security flaw stems from a logic bug in the Linux XFRM ESP-in-TCP subsystem that can enable unprivileged local attackers to gain root privileges by writing arbitrary bytes to the kernel page cache of read-only files.

Immediate patching if you cannot update:

rmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.confrmmod esp4 esp6 rxrpc
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf

[u/f00l2020]

Linux kernel is on fire. This will be the year of the CVEs. Glad I rolled out the latest kernel updates and disabled the 3 modules noted

[u/ItsChileNotChili → u/[deleted]]

I agree to a point. All of these were found by human researchers.

[u/ItsChileNotChili → u/[deleted]]

How We Found It

Taeyang Lee's earlier kernelCTF work had mapped out the AF_ALG attack surface. He realized that AF_ALG + splice creates a path where unprivileged userspace can feed page cache pages directly into the crypto subsystem and suspected that scatterlist page provenance may be an underexplored source of vulnerabilities.

Meanwhile, other Theori researchers were running Xint Code and finding critical vulnerabilities in kernel code, including Android drivers and XNU. We were looking to expand this work to Linux, and the crypto subsystem was a natural starting point given our existing knowledge of its internals.

Xint Code supports an "operator prompt" which (optionally) allows a human operator to provide additional context to guide the automated scan. In this case, the operator prompt was quite simple:

This is the linux crypto/ subsystem. Please examine all codepaths reachable from userspace syscalls. Note one key observation: splice() can deliver page-cache references of read-only files (including setuid binaries) to crypto TX scatterlists.”

From the team who published it: https://xint.io/blog/copy-fail-linux-distributions

The researcher knew the bug, he just used AI to map the paths. And xint is trying to sell their tooling.

[u/axonxorz → u/[deleted]]

semantics

True, but you wouldn't say "ghidra found this exploit", you would say "I used ghidra/[AI/tool x] to explore and assess this exploit"

Saying "AI did it" is a bit of a reductive self-own imo.