# Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP

Logic flaw in Linux XFRM ESP-in-TCP lets unprivileged local users corrupt page cache of read-only files via AES-GCM keystream, overwriting /usr/bin/su for root.

- Payout: Research
- Severity: high
- Program: Linux kernel
- Credited: Wiz Research
- Disclosed: 2026-05-13
- Write-up quality: 7/10
- Original: https://www.wiz.io/blog/fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-fragnesia-linux-kernel-local-privilege-escalation-via-esp-in-tcp
- Tags: domain:oss impact:privesc kind:research platform:threat-intel sev:high tech:linux technique:chained technique:incomplete-fix technique:regression vuln:memory-corruption vuln:privilege-escalation

**Target:** XFRM ESP-in-TCP subsystem (espintcp ULP)
**Root cause:** Improper handling of shared page fragments during skb coalescing: file-backed pages spliced into a TCP receive queue before the socket enters espintcp ULP mode are decrypted in-place, so AES-GCM keystream manipulation writes into the page cache.
**Steps:**
1. Create user and network namespaces to gain CAP_NET_ADMIN in the isolated namespace.
2. Install a crafted ESP security association via `NETLINK_XFRM`.
3. Splice file-backed pages of a target read-only binary (e.g. `/usr/bin/su`) into a TCP receive queue before transitioning the socket to espintcp ULP mode.
4. Enable ESP processing so the kernel decrypts queued data in-place, producing controlled single-byte writes into the cached file page.
5. Repeat to overwrite the first bytes of `/usr/bin/su` with a small ELF payload calling `setresuid(0,0,0)` and `execve("/bin/sh")`.
6. Execute `/usr/bin/su` to obtain a root shell; on-disk binary remains unmodified.
**How found:** Fragnesia emerged as an unintended side effect of one of the patches addressing the original Dirty Frag vulnerabilities, per Dirty Frag's discoverer Hyunwoo Kim.
**Exploitation:** Local unprivileged attacker uses user+net namespaces for CAP_NET_ADMIN, installs crafted XFRM ESP SA, splices target file pages into TCP receive queue pre-ULP-transition, then triggers in-place AES-GCM decryption to write controlled bytes into page cache, replacing /usr/bin/su entry with setresuid(0,0,0)+/bin/sh payload for root.
**Escalation:** Chains namespace privilege acquisition with page-cache corruption of a setuid root binary to convert a local unprivileged position into full root; AppArmor userns restrictions require additional bypass.
**Insight:** Patch-diff regression hunting pays: a fix for one bug (Dirty Frag) introduced a new primitive by changing how shared page fragments are handled during skb coalescing — audit fix commits for new in-place mutation of file-backed pages.