Emergency Security Update | Critical Vulnerabilities – Apply Fix Now (Detailed Steps)
Recently, the UnionTech Security Response Center (USRC) detected two high-risk local privilege escalation vulnerabilities in the Linux kernel, collectively referred to as "Fragnesia" and "ssh-keysign-pwn".
Given their severity and broad impact, UnionTech recommends that all customers adopt the fix solutions provided by USRC to secure both desktop and server operating systems.
🔒 Vulnerability Overview
◉ Fragnesia
CVE ID: CVE-2026-46300
Description: The root cause lies in the kernel’s socket buffer management. The function skb_try_coalesce() fails to properly propagate the SKBFL_SHARED_FRAG flag when merging fragmented buffers, causing the kernel to "forget" that a memory fragment is still shared. Fragnesia exploits a logical flaw in the Linux kernel XFRM ESP-in-TCP subsystem, enabling local privilege escalation.
Severity: High
Exploit Conditions: Attackers require only local unprivileged user access.
Affected Versions: All Desktop Professional and Server editions.
◉ ssh-keysign-pwn
CVE ID: CVE-2026-46333
Description: The vulnerability resides in the Linux kernel ptrace access check logic. The core issue involves ptrace_may_access(), the task exit routine do_exit(), and the dumpable check. During process exit, the kernel releases/detaches the memory descriptor (mm) before closing the file descriptor table. Within a short race window, a privileged process may have no mm but its opened file descriptors still exist. In affected kernels, ptrace_may_access() skips dumpable protection checks when target task mm == NULL. An attacker can exploit this race to copy file descriptors from a dying privileged process via pidfd_getfd(2).
Severity: High
Exploit Conditions: Local unprivileged user access required.
Affected Versions: All Desktop Professional and Server editions.
🛠️ Fix Solutions
UnionTech UOS has integrated official kernel patches and pushed updates to the system repositories. Upgrade your kernel to the secure version to remediate the vulnerabilities.
Security Advisory: https://src.uniontech.com/ – search using CVE-2026-46333 or CVE-2026-46300.
💡 Note: The patches for CVE-2026-46333 and CVE-2026-46300 are identical; installing one also fixes CVE-2026-31431, CVE-2026-43284, and CVE-2026-43500.
◉ Online Upgrade Steps (Internet-connected)
1. Desktop OS
- Control Center → Updates → Update Settings → enable System & Security updates.
- Click “Check for Updates” → “Download All”.
- Click “Install Now”.
- After installation, click “Reboot Now”.
2. Server OS (D edition)
AMD64:
sudo apt update && sudo apt install linux-image-4.19.0-server-amd64 linux-headers-4.19.0-server-amd64
ARM64:
sudo apt update && sudo apt install linux-image-4.19.0-arm64-server linux-headers-4.19.0-arm64-server
After update, run sudo reboot to restart the system.
Other Server versions (yum based):
sudo yum update-minimal --cve CVE-2026-46333 (or CVE-2026-46300)
sudo yum update kernel
Then reboot with sudo reboot.
◉ Offline Patch Installation (Air-gapped environments)
Offline patches: https://src.uniontech.com/ – search by CVE ID, select OS version & architecture.
1. Desktop Professional offline patch
Download the offline upgrade tool, grant execution permission, enter password, accept terms and start upgrade. System will auto-reboot.
2. Server offline patch
Place downloaded .deb packages in an empty folder and run:
sudo dpkg -i *.deb
For rpm-based systems:
sudo rpm -ivh --force --nodeps *.rpm
After installation, reboot to activate the new kernel: sudo reboot.
◉ Verification
Run uname -a to check the current kernel version. If it is equal to or higher than the fixed version listed on USRC, the vulnerability is mitigated.
⚠️ Temporary Mitigations
◉ CVE-2026-46300 (same as Dirty Frag workaround)
💡 Important: The following measures disable esp4, esp6, and rxrpc modules, which may impact IPsec ESP, certain VPN/IPsec services, and RxRPC/AFS. Production validation required. Not applicable to Huawei device models (see Huawei-specific section).
Prevent modules from loading persistently:
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' | sudo tee /etc/modprobe.d/disable-copy-fail-2.conf
Unload already loaded modules:
sudo rmmod esp4 esp6 rxrpc 2>/dev/null
Verify configuration:grep -rE 'install (esp4|esp6|rxrpc) /bin/false' /etc/modprobe.d/
Clean tainted page cache (optional): sync && echo 3 | sudo tee /proc/sys/vm/drop_caches
🔁 Rollback (if needed)
sudo rm /etc/modprobe.d/disable-copy-fail-2.conf sudo modprobe esp4 esp6 rxrpc
📱 Huawei Device Line Mitigation
Affected models: pgv(w515,w585), pgw(w525), klu(L410), klv(L420,L540), pgx(w515x,w585x), flmx(L420x,L540x), pgy(w515y,w585y).
Edit /etc/default/grub and add the following to GRUB_CMDLINE_LINUX_DEFAULT:
initcall_blacklist=esp4_init,esp6_init,af_rxrpc_init
Then update grub and reboot:
sudo update-grub sudo reboot
Verify with: cat /proc/cmdline | grep 'initcall_blacklist=esp4_init,esp6_init,af_rxrpc_init'
◉ CVE-2026-46333 Temporary Workaround (ptrace restriction)
If a reboot is not immediately possible, tighten Yama ptrace scope to block known exploit paths:
sudo sysctl -w kernel.yama.ptrace_scope=3
To make permanent:
echo 'kernel.yama.ptrace_scope = 3' | sudo tee /etc/sysctl.d/99-cve-2026-46333.conf
💡 Important: setting ptrace_scope=3 disables all ptrace attach operations (gdb, strace -p, perf, etc.).
Source: Security Technology Dept. | Edited by: Public Affairs Dept.
