Why does Fragnesia create root risk even without changing the on-disk file?

Why a filesystem-only check misses the real failure mode

Fragnesia is dangerous because the kernel does not execute “the disk file” in isolation. It executes what is already in memory, and the page cache sits on that path. If an attacker can corrupt the cached bytes before execution, a read-only file can still lead to privileged code running even though the on-disk object never changed.

That changes the trust boundary in a subtle but important way. A control that only hashes, scans, or mounts the file read-only may still miss the live execution path if it does not also validate the in-memory state the kernel will use at run time.

Why page-cache tampering becomes root risk

The root-risk element comes from timing and authority, not just file modification. If the cached content is altered between validation and execution, the process can inherit the kernel’s trust in that memory-backed view of the file. In practice, the attacker is not defeating the file permission model, they are bypassing the assumption that disk contents are the only authoritative source.

That makes the issue especially relevant for any workflow that validates executables before launch and then relies on the same object remaining unchanged. Once cached bytes are part of the execution decision, integrity has to be reasoned about across both persistent storage and volatile memory.

What this means for defenders and reviewers

The defensive question is not simply “is the file read-only?” but “what exact bytes will the kernel execute, and can those bytes be altered after validation?” That is why this kind of attack is a root-risk condition even when the filesystem itself looks clean.

When reviewers treat disk immutability as sufficient, they can miss a live compromise path that only exists in the memory layer. The practical consequence is that integrity controls must cover the execution path, not just the stored artifact.

Risk and Threat Considerations

The main risk is a false sense of integrity. A system may appear protected because the file on disk is unchanged, yet the executing image can still be poisoned in memory, creating a direct route to privileged execution.

Failure mechanism: The attacker alters the page cache or another memory-resident execution path after the file has been trusted but before the kernel runs it, so the runtime view diverges from the on-disk object.

Impact: A read-only or previously verified file can still yield root-level compromise, which undermines file-based validation, incident triage, and any control that assumes storage integrity equals execution integrity.

Practitioner Guidance

What to verify: Validate the execution path, not just the artifact. If a control only proves the file on disk is intact, treat it as incomplete unless you also know how the runtime bytes are protected or revalidated before execution.

Common mistake: Teams often equate read-only storage with safe execution. That is the wrong assumption here, because the attacker’s leverage is the in-memory representation the kernel consumes.

Decision rule: If a threat model includes privileged execution from a file-based path, require controls that account for runtime integrity, cache invalidation, and any transition from verified content to executable content.

Practitioner takeaway: The key judgement is that integrity must be measured at the moment of execution, because a trusted file can still become an untrusted program once the memory state is poisoned.

Related resources from NHI Mgmt Group

• Why do agentic file-sharing workflows create governance risk even without obvious malware?
• Why do RAG systems create data exposure risk even without prompt injection?
• Why do AI fraud tools create risk even without frontier model access?
• Why do public IP addresses create security risk even without a breach?