CVE-2026-46300: Fragnesia, local privilege escalation

[Rolv-Apneseth]

Another CVE for LPE, in the same class as dirty frag (tracked by #2142).

See:

• https://github.com/v12-security/pocs/tree/main/fragnesia
• https://lists.openwall.net/netdev/2026/05/13/79
• https://access.redhat.com/security/cve/cve-2026-46300

[travier]

Mitigation is the same as the previous ones: disable the faulty modules: #2142 (comment)

storage:
  files:
    - path: /etc/modprobe.d/dirtyfrag.conf
      contents:
        inline: |
          install esp4 /bin/false
          install esp6 /bin/false
          install rxrpc /bin/false

          blacklist esp4
          blacklist esp6
          blacklist rxrpc

          alias net-pf-33 off
          alias xfrm-type-2-50 off
          alias xfrm-type-10-50 off

[travier]

It is very likely that we'll keep seeing issues like this in the upcoming days. A good way to mitigate that is to disable module loading once everything is started on the system. Creating a systemd unit and having it run sysctl -w kernel.modules_disabled=1 5 minutes after boot should do it.

# /usr/lib/systemd/system/disable-module-loading.timer
[Unit]
Description=Disable module loading 5 minutes after boot

[Timer]
OnBootSec=5m

[Install]
WantedBy=timers.target

# /usr/lib/systemd/system/disable-module-loading.service
[Unit]
Description=Disable module loading 5 minutes after boot

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=sysctl -w kernel.modules_disabled=1

[Rolv-Apneseth]

Forgot to note but @angelcerveraroldan and I confirmed we are vulnerable by running the exploit against local images

[Rolv-Apneseth]

According to a comment in https://lwn.net/Articles/1072647/, Fedora updates are currently in testing:

• https://bodhi.fedoraproject.org/updates/FEDORA-2026-cccb681166
• https://bodhi.fedoraproject.org/updates/FEDORA-2026-4462efc052

[Rolv-Apneseth]

Bugzilla: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2026-46300

[dustymabe]

New update with an additional patch for fragnesia: https://bodhi.fedoraproject.org/updates/FEDORA-2026-6b173ffc2a

[dustymabe]

Opened:

• [testing] overrides: fast-track kernel-7.0.7-200.fc44 fedora-coreos-config#4178
• [next] overrides: fast-track kernel-7.0.7-200.fc44 fedora-coreos-config#4179

[Rolv-Apneseth]

Confirmed the latest next and testing images are not vulnerable to this exploit.