Linux kernel hit by third critical local privilege flaw in weeks

Two new Linux kernel vulnerabilities were disclosed in May 2026, adding to a rapid series of privilege‑escalation bugs.

The first, dubbed “Fragnesia” (CVE‑2026‑46300), exploits a logic error in the XFRM/ESP networking subsystem. By corrupting the page‑cache, an unprivileged local user can overwrite the /usr/bin/su binary in memory and obtain full root rights. Major Linux distributions such as Debian, Ubuntu and Red Hat have issued patches, and administrators are urged to apply updates or disable non‑essential IPsec features until fixes are deployed.

The second flaw (CVE‑2026‑46333) is a ptrace exit‑race in the kernel’s task‑exit path. It allows an unprivileged process to copy file descriptors from a exiting privileged process, exposing SSH host private keys and the shadow password database. The issue affects CloudLinux 8‑10 and AlmaLinux kernels, with live‑patch solutions like KernelCare recommended to mitigate the risk without rebooting. Both vulnerabilities underscore a growing focus on kernel memory‑management bugs and have prompted coordinated patch releases across several Linux‑based operating systems.