Dirty Frag
Security incidents tagged Dirty Frag. Newest first.
1 Dirty Frag incident in the last 12 months
- Incidents
- 1
- Live
- 1
- Patched
- 1
- Days without an incident
- 158
- Longest quiet run: 156 days (May 24–Oct 26)
Show 1 older incident1 older incident
May 2026 1
- Patched
Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign
CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls.
Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce)Since May 13, 2026
