{
  "parent_cve": "CVE-2026-43503",
  "parent_commit": "48f6a5356a33dd78e7144ae1faef95ffc990aae0",
  "variant_cve": "CVE-2026-46300",
  "same_root_cause_confidence": "high",
  "same_root_cause_rationale": [
    "Both the original DirtyClone trigger and the Fragnesia variant reach the same vulnerable sink: in-place ESP/XFRM decryption (esp_input / espintcp) over socket-buffer fragments that reference file-backed page-cache pages.",
    "Both rely on the same invariant failure: a fragment-transfer helper moves page references from one skb to another without propagating the SKBFL_SHARED_FRAG marker in skb_shinfo()->flags.",
    "Both result in skb_has_shared_frag() returning false at the decrypt path, causing skb_cow_data() to be skipped and the decrypt step to write directly into the page cache of a root-owned read-only binary.",
    "Both require the same attacker-controlled preconditions: unprivileged user+network namespaces, CAP_NET_ADMIN inside the namespace, vmsplice/splice zero-copy attachment of a page-cache page to a socket, and an XFRM/ESP policy that routes the packet back to the local host."
  ],
  "same_sink": true,
  "same_sink_detail": "XFRM/ESP receive path in-place decryption over shared page-cache fragments; write primitive against the cached copy of a setuid binary such as /usr/bin/su.",
  "same_vulnerability_class": true,
  "same_vulnerability_class_detail": "Linux kernel sk_buff shared-frag marker loss during fragment transfer (CWE-99/insufficient control over resource, logic flaw in metadata propagation).",
  "different_entry_point": true,
  "different_entry_point_detail": "DirtyClone uses netfilter TEE → __pskb_copy_fclone() on an ESP-in-UDP packet; Fragnesia uses ESP-in-TCP (espintcp) over veth → skb_try_coalesce() in the TCP receive path.",
  "different_helper": true,
  "different_helper_detail": "DirtyClone's helper is __pskb_copy_fclone(); Fragnesia's helper is skb_try_coalesce().  The two helpers are fixed by sibling commits (48f6a5356a33 and the CVE-2026-46300 patch).",
  "trust_boundary_same": true,
  "trust_boundary_detail": "Both variants cross the same trust boundary: unprivileged local user in a private namespace → kernel networking stack → root-owned setuid binary page cache.",
  "patch_relationship": "sibling_fixes",
  "patch_relationship_detail": "The CVE-2026-43503 patch covers six frag-transfer helpers. The CVE-2026-46300 patch covers a seventh helper (skb_try_coalesce). The tested v7.0.10 stable kernel includes both, so Fragnesia is blocked. A partial backport of only CVE-2026-43503 would still be vulnerable to Fragnesia.",
  "negative_result": true,
  "negative_result_detail": "On the fixed v7.0.10 kernel the variant was blocked (RESULT: NOT VULNERABLE). Therefore this variant is not a bypass of the combined mitigation, but it is a real alternate trigger on the vulnerable kernel and would have been a bypass if only CVE-2026-43503 had been applied."
}