Linux kernel XFRM ESP-in-TCP shared-frag marker loss local privilege escalation

#!/usr/bin/env bash
# check-cve-2026-46300.sh
# Heuristic exposure check for CVE-2026-46300 / Fragnesia.
# Outputs one of: VULNERABLE / PATCHED / UNKNOWN
# Exit codes: 0=PATCHED, 1=VULNERABLE, 2=UNKNOWN

set -u

ver_lt() {
  [ "$1" = "$2" ] && return 1
  [ "$(printf '%s\n%s\n' "$1" "$2" | sort -V | head -n1)" = "$1" ]
}

status="UNKNOWN"
reason=""

kernel_release="$(uname -r 2>/dev/null)"
kernel_base="${kernel_release%%-*}"

# Heuristic 1: public PoC path needs espintcp introduced upstream in v5.6.
if ver_lt "$kernel_base" "5.6"; then
  echo "PATCHED - kernel $kernel_release is older than upstream v5.6; Ubuntu notes the public Fragnesia PoC path is not affected in practice on older kernels."
  exit 0
fi

# Helper: is module blacklisted?
module_blacklisted() {
  local mod="$1"
  if command -v modprobe >/dev/null 2>&1; then
    local out
    out="$(modprobe -n -v "$mod" 2>/dev/null || true)"
    echo "$out" | grep -Eq 'install /bin/(false|true)' && return 0
  fi
  if grep -RqsE "^[[:space:]]*install[[:space:]]+$mod[[:space:]]+/bin/(false|true)" /etc/modprobe.d /run/modprobe.d /usr/lib/modprobe.d 2>/dev/null; then
    return 0
  fi
  return 1
}

# Helper: does module exist on disk or loaded?
module_present() {
  local mod="$1"
  lsmod 2>/dev/null | awk '{print $1}' | grep -qx "$mod" && return 0
  find "/lib/modules/$(uname -r)" -type f \( -name "$mod.ko" -o -name "$mod.ko.xz" -o -name "$mod.ko.zst" \) >/dev/null 2>&1 && return 0
  return 1
}

esp4_present=0
esp6_present=0
esp4_blocked=1
esp6_blocked=1
userns_enabled=0

module_present esp4 && esp4_present=1
module_present esp6 && esp6_present=1
module_blacklisted esp4 && esp4_blocked=0
module_blacklisted esp6 && esp6_blocked=0

# user.max_user_namespaces > 0 means user namespaces are enabled
if [ -r /proc/sys/user/max_user_namespaces ]; then
  umn="$(cat /proc/sys/user/max_user_namespaces 2>/dev/null || echo 0)"
  case "$umn" in
    ''|*[!0-9]*) userns_enabled=0 ;;
    0) userns_enabled=0 ;;
    *) userns_enabled=1 ;;
  esac
fi

# If neither ESP module is present, practical exploitability is removed.
if [ "$esp4_present" -eq 0 ] && [ "$esp6_present" -eq 0 ]; then
  echo "PATCHED - esp4/esp6 modules are not present for kernel $kernel_release."
  exit 0
fi

# If both are effectively blocked, treat as patched/not exploitable for this path.
if [ "$esp4_blocked" -eq 0 ] && [ "$esp6_blocked" -eq 0 ]; then
  echo "PATCHED - esp4 and esp6 are blacklisted/disabled, removing the public Fragnesia exploit path."
  exit 0
fi

# If namespaces are enabled and at least one ESP module is available, likely exposed.
if [ "$userns_enabled" -eq 1 ] && { [ "$esp4_present" -eq 1 ] || [ "$esp6_present" -eq 1 ]; }; then
  echo "VULNERABLE - kernel $kernel_release is new enough for the public exploit path, at least one ESP module is available, and unprivileged user namespaces are enabled. Verify vendor backport status and patch level immediately."
  exit 1
fi

# Otherwise we cannot be sure: distro backports and local hardening vary.
echo "UNKNOWN - prerequisites are mixed on kernel $kernel_release. Check vendor advisory/backport status for your distro and whether esp4/esp6 can be loaded by local workloads."
exit 2