Trending Now - Critical Linux Vulnerability Allows Root Access Exploit
WHO:
BleepingComputer - William Bowling, head of assurance at Zellic, discovered the Fragnasia vulnerability.
The Hacker News - Researcher William Bowling of the V12 security team identified the vulnerability.
WHAT:
BleepingComputer - A proof-of-concept (PoC) exploit for Fragnasia has been shared by William Bowling, which can corrupt the page cache memory of the /usr/bin/su binary to gain root privileges.
The Hacker News - The vulnerability is similar to Copy Fail and Dirty Frag, allowing immediate root access on all major distributions by achieving a memory write primitive in the kernel.
The Hacker News - A threat actor named "berz0k" is advertising a zero-day Linux local privilege escalation exploit for $170,000, claiming it works on multiple major Linux distributions.
BleepingComputer - The Fragnasia vulnerability, tracked as CVE-2026-46300, allows attackers to gain root privileges by exploiting a logic bug in the Linux XFRM ESP-in-TCP subsystem.
BleepingComputer - The CVSS score for Fragnasia is 7.8.
BleepingComputer - The vulnerability enables unprivileged local attackers to write arbitrary bytes to the kernel page cache of read-only files.
The Hacker News - Fragnasia is the third local privilege escalation vulnerability identified in the Linux kernel within a span of two weeks.
BleepingComputer - A proof-of-concept (PoC) exploit for Fragnasia has been shared, which can corrupt the page cache memory of the /usr/bin/su binary.
BleepingComputer - Linux users are advised to apply kernel updates as soon as possible to secure their systems against attacks.
WHERE:
BleepingComputer - The vulnerability affects all major Linux distributions.
WHEN:
BleepingComputer - The vulnerability affects all Linux kernels released before May 13, 2026.
BleepingComputer - Federal agencies were ordered to secure their Linux systems by May 15, 2026.
WHY:
BleepingComputer - The U.S. cybersecurity agency warned that this type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise.
BleepingComputer - The vulnerability is part of the Dirty Frag vulnerability class, which poses significant risks to the federal enterprise according to the U.S. cybersecurity agency.
HOW:
The Hacker News - Microsoft stated that a patch is available and urged users to apply it as soon as possible by running update tools.
BleepingComputer - The Fragnasia vulnerability abuses a logic bug in the Linux XFRM ESP-in-TCP subsystem to achieve arbitrary byte writes into the kernel page cache of read-only files.
BleepingComputer - Mitigations for the vulnerability include removing vulnerable kernel modules, which may affect AFS distributed network file systems and IPsec VPNs.
The Hacker News - AppArmor restrictions on unprivileged user namespaces may serve as a partial mitigation for the vulnerability.
(UPDATED May 14, 2026 19:34 UTC)
A new proof-of-concept exploit for a vulnerability known as Fragnasia has been shared, which can corrupt the page cache memory of the /usr/bin/su binary to gain root privileges on major Linux distributions. A threat actor is reportedly advertising a zero-day local privilege escalation exploit for $170,000, highlighting the significant risks posed by such vulnerabilities, which the U.S. cybersecurity agency warns are frequently targeted by malicious actors. Microsoft has responded by stating that a patch is available and is urging users to apply it immediately using their update tools.
--
(UPDATED May 14, 2026 17:37 UTC)
A significant security vulnerability known as Fragnasia, tracked as CVE-2026-46300, has been discovered by researcher William Bowling, allowing attackers to gain root privileges through a logic bug in the Linux XFRM ESP-in-TCP subsystem. This vulnerability, which has a CVSS score of 7.8, affects all major Linux distributions and enables unprivileged local attackers to write arbitrary bytes to the kernel page cache of read-only files, with a proof-of-concept exploit already shared. Federal agencies have been ordered to secure their Linux systems by May 15, 2026, as this vulnerability is part of the Dirty Frag class, posing significant risks to the federal enterprise according to the U.S. cybersecurity agency.