Mitigating Fragnesia (CVE-2026-46300) on Ubuntu Server
A practical guide to assessing, mitigating, and patching the Fragnesia (CVE-2026-46300) kernel vulnerability on Ubuntu Server to prevent privilege escalation.
Recently, I had to deal with Fragnesia (CVE-2026-46300) on one of our local Ubuntu servers. If you haven't been tracking this one, it’s a nasty high-severity Local Privilege Escalation (LPE) flaw rooted in the Linux kernel's XFRM ESP-in-TCP subsystem.
Because the kernel fails to properly track shared page fragments during socket buffer coalescing, an unprivileged local attacker can overwrite the in-memory page cache of read-only files (like /usr/bin/su). The result? Instant root access.
Here is a walkthrough of how I assessed, mitigated, and ultimately resolved the vulnerability on my Ubuntu servers.
Assessing the Initial State
The first step in any kernel vulnerability response is establishing the baseline. I logged into the local server and checked the current active kernel:
uname -r
# Output: 6.17.0-1008-generic
Knowing the system was running an older 6.17.0 release, it was squarely in the vulnerable zone for Fragnesia.
The Temporary Mitigation (Buying Time)
While the ultimate goal is always to patch and reboot, sometimes you need to buy a little time to schedule a maintenance window. Since the vulnerability relies on specific kernel modules to execute the exploit path, you can block it by disabling esp4, esp6, and rxrpc.
Note: Disabling these modules can break IPsec VPN functionality (like StrongSwan). If you previously applied this exact block for the "Dirty Frag" vulnerability, your system is actually already shielded from Fragnesia.
# Blacklist the vulnerable modules
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' | sudo tee /etc/modprobe.d/fragnesia.conf
# Unload them from the running kernel
sudo rmmod esp4 esp6 rxrpc
The Crucial Missing Link: Dropping the Page Cache
Here is a detail that trips up a lot of admins: Fragnesia corrupts the in-memory cached copies of binaries, not the actual files on the disk. Simply blocking the exploit path does not fix files an attacker might have already tampered with in memory.
To completely clean the system state without a reboot, you must force the kernel to drop the page cache. This evicts any compromised pages and forces the system to load fresh, clean copies from the disk:
sudo sh -c "echo 3 > /proc/sys/vm/drop_caches"
Applying the Permanent Fix
Workarounds are great, but patches are better. During our maintenance window, I pulled down the official upstream fixes provided by Canonical for the generic kernel tree.
sudo apt update
sudo apt install --only-upgrade linux-image-generic
Because we weren't running Canonical Livepatch on this specific local server, a full system reboot was mandatory to load the new kernel into memory:
sudo reboot
Verification and Post-Patch Analysis
Once the server came back online, I immediately verified the running kernel version to confirm the patch was actively deployed:
uname -r
# Output: 6.17.0-1015-generic
Status: Resolved. Seeing 6.17.0-1015-generic confirmed we were fully patched. The upgrade permanently closed the logic flaw in the XFRM subsystem. Furthermore, because the server underwent a full reboot, the entire system RAM was wiped. This meant the manual step of dropping the page cache was no longer necessary—any lingering memory corruption was inherently flushed.
At this point, I could safely ignore the temporary module blacklists, as the underlying defect was fixed.
Stay safe, and patch your kernels!