Fragnesia: Check and Patch This Linux LPE on Your Homelab

Fragnesia (CVE-2026-46300) was disclosed in mid-May 2026 as a follow-up to Dirty Frag. Same family, new bug: an unprivileged local user can flip bytes in the page cache of files they can only read, and use that to get root. Public proofs of concept exist, and Qualys reports it being exploited.

What the bug is

The kernel record’s title says it plainly: “net: skbuff: preserve shared-frag marker during coalescing.” When the kernel merges network buffers, it could lose the flag that marks a fragment as shared (for example backed by a file’s page-cache page). Later, the IPsec ESP input path checks that flag before decrypting in place, and without it the kernel decrypts directly into a page it doesn’t own. The name comes from that: the buffer “forgets” its fragment is shared.

According to TuxCare’s analysis, the public exploit:

• creates a user and network namespace (unshare(CLONE_NEWUSER | CLONE_NEWNET)) to get CAP_NET_ADMIN inside it,
• uses ESP-in-TCP (CONFIG_INET_ESPINTCP),
• though the underlying bug may be reachable by other routes.

Fixed kernel versions (CVE record)

Kernel series	Fixed in
5.10	5.10.257
5.15	5.15.208
6.1	6.1.174
6.6	6.6.141
6.12	6.12.91
6.18	6.18.33
7.0	7.0.10
mainline	7.1

Affected range: from 3.9. Your distribution’s backported kernel has its own version number, so check its advisory for CVE-2026-46300:

• Debian: https://security-tracker.debian.org/tracker/CVE-2026-46300
• Ubuntu: https://ubuntu.com/security/CVE-2026-46300

Note that a kernel fixed only for Dirty Frag is not fixed for Fragnesia: it needs this newer patch too.

Patch

uname -r
# Debian / Ubuntu / Proxmox
sudo apt update && sudo apt full-upgrade
# Fedora / RHEL / Rocky / Alma
sudo dnf upgrade --refresh

Use full-upgrade (or dist-upgrade) rather than upgrade on Debian-based systems: new kernel versions often come as new packages, which plain upgrade won’t install when they bring new dependencies. Then reboot and confirm with uname -r.

Proxmox VE: apt update && apt dist-upgrade pulls the current proxmox-kernel. Migrate or shut down guests, reboot one node at a time, and check pvecm status before moving on. LXC containers use the host kernel; VMs need their own updates.

Mitigation until you reboot

Block the modules (recommended). TuxCare states that the Dirty Frag mitigation also protects against the public Fragnesia exploit:

sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"

This breaks kernel IPsec (strongSwan, Libreswan). WireGuard is unaffected.

Restricting user namespaces also stops the public exploit, because it needs one, but it breaks rootless Podman, rootless Docker, Flatpak and some browsers’ sandboxes. On most distributions that’s user.max_user_namespaces=0; Debian and Ubuntu kernels also have kernel.unprivileged_userns_clone. Prefer the module block, and don’t switch rootless containers to rootful to work around it: rootful containers make every kernel exploit worse.

Either way, it’s temporary: install the fixed kernel and reboot.

What’s Next

• Proxmox VE Homelab Setup: Complete Installation and Configuration Guide (2026): Lock down your Proxmox host properly after this patch scare
• Podman Rootless Containers and the Copy Fail Exploit: What Homelab Users Need to Know: Understanding rootless containers and when they actually matter for security
• Mitigating 400+ Linux Kernel CVEs in Your Homelab: Turn this one-off patch into a repeatable triage and update routine
• MicroVMs in Proxmox: True Homelab Isolation, Simply: Defence in depth, limit the blast radius of any local exploit with real isolation