What Is Fragnesia?
Fragnesia is a memory flaw in the Linux kernel's network code, where IPsec (ESP) traffic carried over TCP is handled. The kernel loses track of whether a piece of memory is shared, then decrypts data in place over memory it shouldn't touch. A user already on the machine can use that to become root.
It is rated 7.8 out of 10 because the attacker needs to be on the machine first. But "on the machine" includes a hacked website: someone who gets in through a web-app flaw runs as the web server's user, and Fragnesia turns that into full control.
It was disclosed in May 2026. CISA added it to its list of flaws being exploited on 28 October 2026.
Am I Affected?
Almost every Linux server running a kernel without the fix. Check what's running now:
uname -r| Kernel line | Fixed in |
|---|---|
| 7.0 | 7.0.10 |
| 6.18 | 6.18.33 |
| 6.12 | 6.12.91 |
| 6.6 | 6.6.141 |
| 6.1 | 6.1.174 |
| 5.15 | 5.15.208 |
Distribution kernels (Ubuntu, Debian, Red Hat and the rest) use their own version numbers. Check your distribution's security notice for this CVE to see which of its kernels is fixed.
How to Fix It
- Install the updated kernel:
sudo apt update && sudo apt full-upgradeon Ubuntu or Debian,sudo dnf upgrade kernelon Red Hat, Rocky or Alma. - Reboot. A new kernel does nothing until the machine restarts on it. This is the step most often missed.
- Run
uname -ragain to confirm.
If you can't reboot soon, a live-patching service (Ubuntu Livepatch, kpatch and others) may cover it. Check that it lists this CVE.
After Patching
The machines most at risk are web servers that also had an unpatched web app. If either was exposed, look for new users, SSH keys and cron jobs, and for processes running as root that you don't recognise.