---
id: 6835
title: "Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP"
source_domain: wiz.io
source_url: "https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp"
published_at: "2026-05-13T12:13:44Z"
tags: ["privilege-escalation", "linux-kernel", "vulnerability", "fragnesia", "dirtyfrag", "page-cache"]
phying_url: "https://phying.com/item/6835"
lang: en
---

# Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP

## Summary

Fragnesia, a new DirtyFrag-family Linux LPE, abuses XFRM ESP-in-TCP skb coalescing and AES-GCM keystream manipulation to corrupt the page cache and overwrite /usr/bin/su in memory for root.

## Intelligence Metadata

- **Sources:** wiz.io
- **Published:** 2026-05-13T12:13:44Z
- **Original:** https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
- **Phying News:** https://phying.com/item/6835