Fragnesia (CVE-2026-46300) - Debian 13 patch

fragnesia-debian-13-patch.sh

#!/usr/bin/env bash
set -Eeuo pipefail

# Fragnesia / CVE-2026-46300 temporary mitigation for Debian 13 / trixie.
# This blocks esp4, esp6 and rxrpc from being loaded on the host kernel.
#
# Safe for typical QEMU/KVM VPS nodes that do not terminate IPsec/ESP on the host.
# This can break host-level IPsec/strongSwan/Libreswan ESP usage, or AFS/rxrpc usage.

CONF_FILE="/etc/modprobe.d/fragnesia.conf"
MODULE_PATTERN='^(esp4|esp6|rxrpc)\b'

if [[ "${EUID}" -ne 0 ]]; then
    echo "ERROR: Run this script as root."
    exit 1
fi

echo "[1/6] Writing module block rules to ${CONF_FILE}"

cat > "${CONF_FILE}" <<'EOF'
# Fragnesia / CVE-2026-46300 temporary mitigation.
# Blocks future loading of vulnerable modules through modprobe.

install esp4 /bin/false
install esp6 /bin/false
install rxrpc /bin/false
EOF

echo "[2/6] Trying to unload modules if already loaded"

modprobe -r esp4 esp6 rxrpc 2>/dev/null || true

echo "[3/6] Checking currently loaded modules"

if lsmod | grep -E "${MODULE_PATTERN}"; then
    echo "WARNING: One or more vulnerable modules are still loaded."
    echo "They may be in use by IPsec/ESP or rxrpc/AFS on this host."
else
    echo "OK: esp4/esp6/rxrpc not loaded"
fi

echo "[4/6] Updating initramfs if update-initramfs exists"

if command -v update-initramfs >/dev/null 2>&1; then
    update-initramfs -u -k all
    echo "OK: initramfs updated"
else
    echo "WARNING: update-initramfs not found, skipping"
fi

echo "[5/6] Flushing filesystem buffers and dropping caches"

sync
echo 3 > /proc/sys/vm/drop_caches

echo "[6/6] Verifying that modules are blocked"

modprobe esp4 2>/dev/null || echo "OK: esp4 blocked"
modprobe esp6 2>/dev/null || echo "OK: esp6 blocked"
modprobe rxrpc 2>/dev/null || echo "OK: rxrpc blocked"

if lsmod | grep -E "${MODULE_PATTERN}"; then
    echo "WARNING: Vulnerable module still loaded after mitigation."
    echo "Check host-level IPsec/ESP/rxrpc usage."
    exit 2
else
    echo "OK: vulnerable modules not loaded"
fi

cat <<'EOF'

Done.

Debian security repo and kernel update notes:

1. Check current kernel:
   uname -r

2. Make sure Debian 13 security repo exists.
   For classic /etc/apt/sources.list syntax, Debian 13 / trixie security repo is:

   deb http://security.debian.org/ trixie-security main contrib non-free non-free-firmware

   Example add command:

   grep -R "trixie-security" /etc/apt/sources.list /etc/apt/sources.list.d/*.list /etc/apt/sources.list.d/*.sources 2>/dev/null || \
   echo "deb http://security.debian.org/ trixie-security main contrib non-free non-free-firmware" >> /etc/apt/sources.list

3. Update package index:

   apt update

4. Upgrade currently available security/kernel packages:

   apt install --only-upgrade linux-image-amd64 linux-headers-amd64

   Or, if you want all available security/stable updates too:

   apt upgrade

5. If a new fixed kernel is installed, reboot into it:

   reboot

6. After reboot, verify:

   uname -r
   dpkg -l | grep -E '^ii\s+linux-image'
   lsmod | grep -E '^(esp4|esp6|rxrpc)\b' || echo "OK: vulnerable modules not loaded"

7. After Debian releases a fixed kernel for CVE-2026-46300, you can remove this temporary mitigation only if you need IPsec/ESP/rxrpc:

   rm -f /etc/modprobe.d/fragnesia.conf
   update-initramfs -u -k all
   reboot

EOF