Hi everyone,

Here we go again.  A third local-root flaw in the Linux kernel has been disclosed today
in the same code area as Copy Fail and Dirty Frag. The bug, named
"Fragnesia" by researcher William Bowling of the V12 security team,
is tracked as CVE-2026-46300, and a working proof-of-concept is
already public.

Fragnesia is a logic flaw in the core socket-buffer code
(skb_try_coalesce loses the SKBFL_SHARED_FRAG marker) that the XFRM
ESP-in-TCP receive path then turns into in-place AES-GCM decryption
over page-cache pages an unprivileged user controls. The end result
is arbitrary byte writes into read-only files such as /usr/bin/su,
i.e. immediate local root.

All supported AlmaLinux releases (8, 9, 10) are affected through
esp4 / esp6, which ship in the standard kernel package. AlmaLinux 9
and 10 are additionally affected through rxrpc, but only on systems
that have installed the kernel-modules-partner package from the
Devel repository. AlmaLinux 8 does not build rxrpc.

The AlmaLinux core team has built patched kernels using the upstream
skbuff fix, ahead of any Red Hat update, with ALESCo approval. They
are available in the almalinux-testing repository today and will
move to production once the community has helped verify them.

  AlmaLinux 8:  kernel-4.18.0-553.124.2.el8_10
  AlmaLinux 9:  kernel-5.14.0-611.54.4.el9_7
  AlmaLinux 10: kernel-6.12.0-124.56.2.el10_1

A dedicated Kitten 10 build will follow shortly.

If you run AlmaLinux anywhere untrusted users can get a shell
(multi-tenant hosts, container build farms, CI runners, shared
developer boxes), please install the patched kernel from testing
and help us verify it, or apply the one-line modprobe blacklist
mitigation in the blog post. The same mitigation already used for
Dirty Frag (esp4 / esp6 / rxrpc) also blocks Fragnesia, so if you
applied that one you are already covered.

Full write-up, install steps, NVRs, and the mitigation command:

  https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/

References:

  NVD:     https://nvd.nist.gov/vuln/detail/CVE-2026-46300
  Red Hat: https://access.redhat.com/security/cve/CVE-2026-46300
  PoC:     https://github.com/v12-security/pocs/tree/main/fragnesia

Please report any problems with the patched kernel in
https://chat.almalinux.org or on https://bugs.almalinux.org so we
can get this into the production repositories quickly.