Marco (Marc) Ayala

A new variant of the recent Dirty Frag vulnerability, named Fragnesia (CVE-2026-46300), has been discovered in the Linux XFRM ESP-in-TCP subsystem. Similar to Dirty Frag, Fragnesia exploits a vulnerability in the XFRM ESP-in-TCP subsystem to achieve a memory write primitive in the kernel. The primitive is then used to corrupt the page cache memory of the [/]usr[/]bin[/]su binary, which in turn leads to launching a shell with root privilege. Note that exploitation is not constrained to use the [/]usr[/]bin[/]su binary; it can modify any file readable by the user, including [/]etc[/]passwd. A patch is available, and while no in-the-wild exploitation has been observed at this time, we urge users and organizations to apply the patch as soon as possible by running update tools. If patching is not possible at this point, consider applying the same mitigations for Dirty Frag, such as: - Assess whether esp4, esp6, and related xfrm/IPsec functionality can be temporarily disabled safely - Restrict unnecessary local shell access - Harden containerized workloads - Increase monitoring for abnormal privilege escalation activity Microsoft Defender detects and blocks known Fragnesia proof-of-concept (PoC) exploit codes using existing detections for Dirty Frag, such as Trojan:Linux/DirtyFrag.DA!MTB or Trojan:Linux/DirtyFrag.Z!MTB. Microsoft continues to investigate the issue, and we'll share updates as more information becomes available.