AlmaLinux’s writeup on Fragnesia (CVE-2026-46300) details the third local-root in the ESP/rxrpc neighborhood in two weeks: this time skb_try_coalesce() fails to propagate the SKBFL_SHARED_FRAG marker, which lets the XFRM ESP-in-TCP path AES-GCM-decrypt directly over page-cache pages and XOR a chosen keystream into /usr/bin/su.
AlmaLinux 8/9/10 are all vulnerable through esp4/esp6 (plus rxrpc on AL9/10 if kernel-modules-partner is installed); AlmaLinux pushed patched kernels (4.18.0-553.124.3.el8_10, 5.14.0-611.54.5.el9_7, 6.12.0-124.56.3.el10_1) to production on May 16, ahead of Red Hat.
PoCs are public in V12’s pocs repository, and Enginsight published a German-language analysis that pairs nicely with this one if your reading list runs bilingual.
At this point the socket-buffer coalescing logic deserves its own threat model.
