Linux Kernel vulnerability known as Fragnesia allows privilege escalation

A critical vulnerability in the Linux kernel, identified as Fragnesia (CVE-2026-46300), is being actively exploited by attackers to achieve privilege escalation. The flaw resides in how the kernel processes network data, specifically during the merging of TCP receive data. This error causes a loss of important markings for memory fragments, potentially allowing attackers to overwrite memory areas containing cached file contents.

While the vulnerability requires local access or existing low-level user privileges rather than being a direct entry point from the internet, it significantly increases the impact of an initial breach. Anthropic’s Frontier Red Team demonstrated a root exploit for the vulnerability (CVE-2026-98432), showing that remote root commands could be executed without user interaction or credentials.

Red Hat has released patches for RHEL 8, 9, and 10 as of November 1. Red Hat noted that the vulnerability affects a broader range of systems than previously thought, as it is not limited to those using Multipath TCP (MPTCP). The flaw stems from the general processing of incoming IPv4-TCP connection requests, specifically involving TCP-SYN packets with IPv4 options like Record Route or Timestamp.