CVE-2026-46300 (Fragnesia) kernel vulnerability: Non-impact statement -

Vulnerability details

On May 13, 2026, security researchers publicly disclosed a Linux kernel local privilege escalation vulnerability, CVE-2026-46300, codenamed Fragnesia. This vulnerability belongs to a class of page cache write vulnerabilities related to the splice() zero-copy mechanism. It is an extension of the same vulnerability pattern seen in Dirty Pipe (CVE-2022-0847), Copy Fail (CVE-2026-31431), and Dirty Frag (CVE-2026-43284 / CVE-2026-43500).

Technical principle

The root cause of the Fragnesia vulnerability is a flaw in the skb_try_coalesce() function within the Linux kernel's core network stack when processing ESP-in-TCP (XFRM ESP over TCP) packets. An attacker can exploit this flaw by loading the esp4, esp6, or rxrpc kernel modules and crafting a special network packet path. This triggers the flaw, allowing an XOR keystream to be written to a read-only page cache, thereby modifying read-only file content on the file system and achieving local privilege escalation to root.

Compared to Dirty Frag, the Fragnesia exploit is more reliable and achieves arbitrary page cache writes without requiring a race condition.

Affected kernel modules

net/core/skbuff.c — skb_try_coalesce() function
net/ipv4/esp4.c — IPv4 ESP protocol handling
net/ipv6/esp6.c — IPv6 ESP protocol handling
net/rxrpc/ — RxRPC protocol stack

Upstream impact

Fragnesia affects Linux kernel versions released since 2017. Because skb_try_coalesce() is a core, general-purpose function in the kernel's network subsystem and ESP/IPsec support is enabled by default in most kernel configurations, the vulnerability is widespread, affecting multiple mainstream Linux distributions and their various mainline kernel versions.

Confirmed affected upstream kernel versions span multiple Long Term Support (LTS) branches, including the 4.x, 5.x, and 6.x series. Because the vulnerable function is in the kernel's core network stack, any Linux distribution that uses a kernel released after 2017 and has the ESP-in-TCP feature enabled is potentially affected.

Current database status: As of May 14, 2026, CVE-2026-46300 has not yet been officially listed by the NVD (National Vulnerability Database), MITRE CVE AWG, Debian Security Tracker, or Amazon Linux ALAS. The corresponding CVSS score and CWE classification are pending release by these official bodies.

Alibaba Cloud Linux impact status

After an evaluation by the Alibaba Cloud Linux kernel security team, no Alibaba Cloud Linux versions are affected by CVE-2026-46300.

Alibaba Cloud Linux version	Latest kernel version	Affected status	Basis
Alibaba Cloud Linux 2	4.19.91-28.5.al7	Not affected	`CONFIG_INET_ESPINTCP` is not set; `CONFIG_INET6_ESPINTCP` is not set
Alibaba Cloud Linux 3	5.10.134-19.3.1.al8	Not affected	`CONFIG_INET_ESPINTCP` is not set; `CONFIG_INET6_ESPINTCP` is not set
Alibaba Cloud Linux 4	6.6.102-5.3.1.alnx4	Not affected	`CONFIG_INET_ESPINTCP` is not set; `CONFIG_INET6_ESPINTCP` is not set

Rationale for non-impact

The exploit chain for the Fragnesia vulnerability relies on the ESP-in-TCP feature, which is controlled by the kernel configuration options CONFIG_INET_ESPINTCP (IPv4) and CONFIG_INET6_ESPINTCP (IPv6). The ANCK (Alibaba Cloud Linux Kernel), an enterprise-grade custom kernel used in all Alibaba Cloud Linux products, does not compile these two configuration options by default. Therefore, an attacker cannot trigger the vulnerability in skb_try_coalesce() through the ESP-in-TCP path, and the exploit chain is broken in the Alibaba Cloud Linux environment.

You can verify this by running the following command:

zgrep -E "CONFIG_INET_ESPINTCP|CONFIG_INET6_ESPINTCP" /proc/config.gz

The expected output is:

# CONFIG_INET_ESPINTCP is not set
# CONFIG_INET6_ESPINTCP is not set

Follow-up plan

Although Alibaba Cloud Linux is not affected by this vulnerability, the Alibaba Cloud Linux kernel security team will continue to track CVE-2026-46300:

Patch tracking: We will closely monitor the upstream Linux kernel community and stable branches for fixes for this CVE.
Proactive assessment: Although not currently affected, the ANCK team will evaluate upstream patches and incorporate relevant security hardening into future kernel updates to guard against potential variant attacks.
Intelligence monitoring: We will continue to monitor public Proof of Concept (PoC) releases and community intelligence to ensure a timely response if the threat landscape changes.

Recommended actions

Alibaba Cloud Linux users do not need to take any immediate mitigation measures for CVE-2026-46300. However, we recommend that you perform regular system updates to receive the latest kernel security patches.
If you use other Linux distributions (not Alibaba Cloud Linux) with the ESP-in-TCP feature enabled, consult your distribution's security advisory to determine if temporary mitigation measures, such as kernel module blacklisting, are necessary.