Fragnesia

Incident Report for CloudLinux

Identified

Fragnesia is a separate bug from Dirty Frag, not a re-announcement. It is, however, in the same XFRM/ESP class and the immediate mitigation is identical. Customers who have already applied the Dirty Frag mitigation need no further action until patched kernels are released.

Affected CloudLinux versions
CloudLinux 7 (CL7) No
CloudLinux 7h (CL7h) Yes
CloudLinux 8 (CL8) Yes
CloudLinux 9 (CL9 ) Yes
CloudLinux 10 (CL10) Yes

Apply this mitigation now
Until a patched kernel or KernelCare livepatch is installed, blacklist the esp4, esp6, and rxrpc modules so they cannot be loaded, and unload them if already present:
sudo sh -c "printf 'install esp4 /bin/false\ninstall esp6 /bin/false\ninstall rxrpc /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf; rmmod esp4 esp6 rxrpc 2>/dev/null; true"
If you already applied this exact mitigation for Dirty Frag, no further action is required. The file already exists and Fragnesia is blocked by the same rule.

We've published a blog post with a lot of up-to-date information on the issue:
Fragnesia — Mitigation and Kernel Update on CloudLinux
Posted May 13, 2026 - 15:31 UTC