Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300

What to do

1. Run uname -r on every Linux host and compare it with your distribution's fixed kernel for CVE-2026-46300.
2. Install the fixed kernel and reboot into it, starting with internet-facing web servers, shared hosts, CI runners and container nodes.
3. Before rebooting any host that was exposed to PHP2Shell or other web exploits, run the detection checks first; a reboot erases the in-memory tampering.
4. If you cannot reboot yet and do not use IPsec, block the esp4 and esp6 modules (and rxrpc if unused) through /etc/modprobe.d and unload them.
5. If you need IPsec, set user.max_user_namespaces=0 as a stopgap where rootless containers and sandboxed apps allow it.
6. Ask vendors of Linux-based firewalls and appliances whether their firmware includes the fix, and patch PHP2Shell on them as well.

How to check if you are affected or compromised

• Check whether esp4, esp6 or espintcp are loaded on hosts that never use IPsec (lsmod | grep -E 'esp4|esp6'); the exploit needs them, so an unexplained load is a lead.
• Before any reboot, verify /usr/bin/su and /etc/pam.d/su against package metadata (rpm -V util-linux, debsums -c or dpkg --verify) and look for pam_permit.so in /etc/pam.d/su.
• Look for su or root shells whose parent chain leads back to a web server user (nobody, www-data, apache).
• Hunt for persistence that survives a reboot: new systemd units, edits to /etc/rc.local, reverse SSH tunnels, and small PHP files in web-accessible directories.

What happened#

On October 28, 2026, CISA added CVE-2026-46300, a Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog. It gave federal agencies until October 31, a three-day deadline, and marked forensic triage as required. CISA's notes say the bug can be chained with the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) "to plant PHP webshells and run commands as root."

The bug itself is not new. William Bowling of the V12 team disclosed it on oss-security on May 13, 2026, with a working exploit, and described it as "a member of the Dirty Frag vulnerability class." According to the CVE record, skb_try_coalesce() drops the shared-fragment marker when it merges socket buffers. ESP then believes it can decrypt in place, and it writes over page-cache pages that belong to files. The public proof of concept uses this to overwrite the first 192 bytes of /usr/bin/su in memory and then runs it to get a root shell. No race is involved, and the change never reaches disk. Rapid7 ships a Metasploit module. The Linux CNA and Red Hat score it CVSS 3.1 7.8.

The exploitation that matters was reported by Dream Research on October 26. An operator it calls "Chinese-nexus" (not a named group) used a custom PHP2Shell exploit to run commands as nobody on a firewall vendor's PHP management interface. The operator then used Fragnesia to overwrite /etc/pam.d/su with a pam_permit.so rule and ran su root with no password. Dream counts 24 rooted firewalls from an unnamed large vendor, plus an internal management server, across the US, Japan, Taiwan and South Korea, including a US government-affiliated network. Persistence was a reverse SSH tunnel wrapped in a systemd service and an rc.local hook, plus small PHP webshells.

Who is affected#

The fix is upstream commit f84eca581739, in stable 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. The CVE record marks kernels from 3.9 as affected. Rapid7 dates the exploitable ESP-in-TCP path to 4.10. Distribution status:

• Red Hat: RHSB-2026-003 lists RHEL 8, 9 and 10 and RHEL-kernel products, including CoreOS and OpenShift, as affected, with fixes released for all of them. Red Hat rates it Important (CVE page).
• Ubuntu: fixed in 26.04 (7.0.0-22.22), 25.10 (6.17.0-35.35), 24.04 (6.8.0-124.124) and 22.04 (5.15.0-181.191). Ubuntu 20.04 and older are listed as not affected.
• Debian: fixed through DSA-6295-1 (trixie), DSA-6306-1 (bookworm) and DLA-4606-1 (bullseye).
• Others: Tenable lists AlmaLinux and Fedora fixes from May and says Amazon Linux does not ship the espintcp module.

Patches for the original Dirty Frag bugs (CVE-2026-43284 and CVE-2026-43500) do not fix Fragnesia. A kernel needs this specific commit.

Do you really need to act?#

This is a local bug, so an attacker first needs to run code as some user. That is exactly what web exploits deliver, and the PHP2Shell chain shows the two steps taking under 15 minutes. If a host runs internet-facing code, tenant workloads, CI jobs or shell users, treat Fragnesia as the step from "web shell as nobody" to "root". The exploit is public, reliable and race-free.

The PoC creates user and network namespaces to get CAP_NET_ADMIN, and it needs the esp4 or esp6 modules. Ubuntu's AppArmor restriction on unprivileged user namespaces blocks the PoC as written. The V12 README says other bugs could get around that, so do not rely on it alone. Single-user workstations and hosts with no untrusted code are lower priority, but they should still get the kernel on the next cycle.

The firewall victims are a warning about appliances. If a Linux-based device exposes a PHP or other web interface, you cannot patch its kernel yourself, so press the vendor for firmware with both fixes.

What to do now#

1. Inventory kernels: uname -r, then compare against your distribution's fixed package (apt list --installed 'linux-image*', rpm -q kernel).
2. Install the fixed kernel and reboot into it: apt-get update && apt-get install --only-upgrade 'linux-image*' or dnf update kernel. A package install alone does not patch the running kernel.
3. On hosts exposed to PHP2Shell, run the checks below before rebooting.
4. Without IPsec, apply Red Hat's module block: printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf, then rmmod esp4 esp6. V12 also blocks rxrpc.
5. With IPsec, Red Hat's alternative is echo "user.max_user_namespaces=0" > /etc/sysctl.d/dirtyfrag.conf followed by sysctl --system. This breaks rootless containers, Flatpak and some browser sandboxes.
6. Patch PHP2Shell as well, so attackers lose the foothold this exploit builds on.

How to tell if you were hit#

The tampering lives in the page cache, so a reboot or echo 3 > /proc/sys/vm/drop_caches removes the evidence along with the backdoor. Check first. Normal reads see the modified cache, so rpm -V util-linux pam, debsums -c or dpkg --verify should flag a tampered /usr/bin/su or /etc/pam.d/su. Also run grep pam_permit /etc/pam.d/su. Look for esp4 or esp6 loaded on hosts that never use IPsec, and for su or root shells descended from web server users. Dream's persistence survives a reboot, so look for new systemd units, /etc/rc.local edits, outbound SSH tunnels and small PHP files in web-readable paths. Dream published no IP addresses or hashes.

Timeline#

• May 13, 2026 — V12 discloses Fragnesia on oss-security with a public exploit. The CVE ID is reserved.
• May 21, 2026 — The fix is merged into the netdev tree, according to HOL.
• May 23, 2026 — The CVE record is published, listing fixed stable kernels.
• Oct 8, 2026 — Dream's attacker begins setup and exploit development.
• Oct 23, 2026 — The first government-affiliated firewall is rooted through the PHP2Shell and Fragnesia chain.
• Oct 26, 2026 — Dream Research publishes its report.
• Oct 28, 2026 — CISA adds CVE-2026-46300 to KEV, with an Oct 31 deadline.

Vulnerability records

• CVE-2026-46300 · KEV 2026-10-28 · In the Linux kernel, the following vulnerability has been resolved: net: skbuff: preserve shared-frag marker during coalescing skb_try_coalesce() can attach…

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. CISA — Known Exploited Vulnerabilities: CVE-2026-46300 cisa.gov
2. CISA — CISA adds two known exploited vulnerabilities to catalog (Oct 28, 2026) cisa.gov
3. CVE record — CVE-2026-46300 cve.org
4. oss-security — Fragnesia disclosure (May 13, 2026) openwall.com
5. Linux kernel — net: skbuff: preserve shared-frag marker during coalescing git.kernel.org
6. V12 Security — Fragnesia proof of concept github.com
7. Red Hat — CVE-2026-46300 access.redhat.com
8. Red Hat — RHSB-2026-003: Dirty Frag and Fragnesia access.redhat.com
9. Ubuntu — CVE-2026-46300 ubuntu.com
10. Debian security tracker — CVE-2026-46300 security-tracker.debian.org
11. Dream Research — Chained PHP2Shell exploit roots 25 servers dreamgroup.com
12. Tenable — Fragnesia (CVE-2026-46300) FAQ tenable.com
13. Rapid7 — Fragnesia LPE Metasploit module rapid7.com
14. HOL — Fragnesia campaign record hol.org