---
title: "Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300"
url: https://erroneo.us/security/briefs/fragnesia-linux-kernel-lpe-cve-2026-46300/
description: "Linux ESP-in-TCP page-cache write gives local users root; chained with PHP2Shell to root 25 servers. In CISA KEV. Boot a fixed kernel now."
type: security-brief
section: "Security Digest"
date_published: 2026-10-28
date_modified: 2026-10-28
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Act now"
cves: ["CVE-2026-46300"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Fragnesia: Exploited Linux Kernel Root Bug CVE-2026-46300

**Verdict: Act now.** Any Linux host that runs untrusted or internet-facing code should be on a kernel with the May 2026 fix today; attackers are now using this public, race-free root exploit right after a web foothold.

- **Who must act:** Owners of Linux servers, container nodes, CI runners and shared hosts where web apps (especially PHP), tenants or untrusted jobs run as non-root users, plus anyone operating Linux-based appliances that serve web interfaces.
- **Who can relax:** Hosts already booted into a distribution kernel that includes the fix, Ubuntu 20.04 and older on standard kernels, and Amazon Linux, which Tenable says does not ship the espintcp module.
- **Affected:** Linux kernel 3.9 and later without commit f84eca581739 (exploitable ESP-in-TCP path since 4.10); Linux stable before 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10; RHEL 8, 9 and 10 and RHEL-kernel products (CoreOS, OpenShift) before fixed errata; Ubuntu 22.04, 24.04, 25.10 and 26.04 before the fixed linux packages; Debian bullseye, bookworm and trixie before DLA-4606-1, DSA-6306-1, DSA-6295-1
- **Fixed:** Linux 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10, 7.1; Ubuntu 26.04 linux 7.0.0-22.22, 25.10 6.17.0-35.35, 24.04 6.8.0-124.124, 22.04 5.15.0-181.191; Debian DSA-6295-1 (trixie), DSA-6306-1 (bookworm), DLA-4606-1 (bullseye); AlmaLinux 8 kernel-4.18.0-553.124.2.el8_10, 9 kernel-5.14.0-611.54.4.el9_7, 10 kernel-6.12.0-124.56.2.el10_1; RHEL 8, 9, 10: fixed errata per RHSB-2026-003
- **CVEs:** CVE-2026-46300
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Run uname -r on every Linux host and compare it with your distribution's fixed kernel for CVE-2026-46300.
2. Install the fixed kernel and reboot into it, starting with internet-facing web servers, shared hosts, CI runners and container nodes.
3. Before rebooting any host that was exposed to PHP2Shell or other web exploits, run the detection checks first; a reboot erases the in-memory tampering.
4. If you cannot reboot yet and do not use IPsec, block the esp4 and esp6 modules (and rxrpc if unused) through /etc/modprobe.d and unload them.
5. If you need IPsec, set user.max_user_namespaces=0 as a stopgap where rootless containers and sandboxed apps allow it.
6. Ask vendors of Linux-based firewalls and appliances whether their firmware includes the fix, and patch PHP2Shell on them as well.

### How to check if you are affected

- Check whether esp4, esp6 or espintcp are loaded on hosts that never use IPsec (lsmod | grep -E 'esp4|esp6'); the exploit needs them, so an unexplained load is a lead.
- Before any reboot, verify /usr/bin/su and /etc/pam.d/su against package metadata (rpm -V util-linux, debsums -c or dpkg --verify) and look for pam_permit.so in /etc/pam.d/su.
- Look for su or root shells whose parent chain leads back to a web server user (nobody, www-data, apache).
- Hunt for persistence that survives a reboot: new systemd units, edits to /etc/rc.local, reverse SSH tunnels, and small PHP files in web-accessible directories.

## What happened

On October 28, 2026, CISA added [CVE-2026-46300](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300), a Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog. It gave federal agencies until October 31, a three-day deadline, and marked forensic triage as required. CISA's notes say the bug can be chained with the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) "to plant PHP webshells and run commands as root."

The bug itself is not new. William Bowling of the V12 team disclosed it on [oss-security on May 13, 2026](https://www.openwall.com/lists/oss-security/2026/05/13/5), with a working exploit, and described it as "a member of the Dirty Frag vulnerability class." According to the [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-46300), `skb_try_coalesce()` drops the shared-fragment marker when it merges socket buffers. ESP then believes it can decrypt in place, and it writes over page-cache pages that belong to files. The [public proof of concept](https://github.com/v12-security/pocs/tree/main/fragnesia) uses this to overwrite the first 192 bytes of `/usr/bin/su` in memory and then runs it to get a root shell. No race is involved, and the change never reaches disk. [Rapid7](https://www.rapid7.com/db/modules/exploit/linux/local/cve_2026_46300_fragnesia/) ships a Metasploit module. The Linux CNA and Red Hat score it CVSS 3.1 7.8.

The exploitation that matters was reported by [Dream Research](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) on October 26. An operator it calls "Chinese-nexus" (not a named group) used a custom PHP2Shell exploit to run commands as `nobody` on a firewall vendor's PHP management interface. The operator then used Fragnesia to overwrite `/etc/pam.d/su` with a `pam_permit.so` rule and ran `su root` with no password. Dream counts 24 rooted firewalls from an unnamed large vendor, plus an internal management server, across the US, Japan, Taiwan and South Korea, including a US government-affiliated network. Persistence was a reverse SSH tunnel wrapped in a systemd service and an `rc.local` hook, plus small PHP webshells.

## Who is affected

The fix is upstream commit [f84eca581739](https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3), in stable 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1. The CVE record marks kernels from 3.9 as affected. Rapid7 dates the exploitable ESP-in-TCP path to 4.10. Distribution status:

- **Red Hat:** [RHSB-2026-003](https://access.redhat.com/security/vulnerabilities/RHSB-2026-003) lists RHEL 8, 9 and 10 and RHEL-kernel products, including CoreOS and OpenShift, as affected, with fixes released for all of them. Red Hat rates it Important ([CVE page](https://access.redhat.com/security/cve/CVE-2026-46300)).
- **Ubuntu:** [fixed](https://ubuntu.com/security/CVE-2026-46300) in 26.04 (7.0.0-22.22), 25.10 (6.17.0-35.35), 24.04 (6.8.0-124.124) and 22.04 (5.15.0-181.191). Ubuntu 20.04 and older are listed as not affected.
- **Debian:** [fixed](https://security-tracker.debian.org/tracker/CVE-2026-46300) through DSA-6295-1 (trixie), DSA-6306-1 (bookworm) and DLA-4606-1 (bullseye).
- **Others:** [Tenable](https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc) lists AlmaLinux and Fedora fixes from May and says Amazon Linux does not ship the espintcp module.

Patches for the original Dirty Frag bugs (CVE-2026-43284 and CVE-2026-43500) do not fix Fragnesia. A kernel needs this specific commit.

## Do you really need to act?

This is a local bug, so an attacker first needs to run code as some user. That is exactly what web exploits deliver, and the PHP2Shell chain shows the two steps taking under 15 minutes. If a host runs internet-facing code, tenant workloads, CI jobs or shell users, treat Fragnesia as the step from "web shell as `nobody`" to "root". The exploit is public, reliable and race-free.

The PoC creates user and network namespaces to get `CAP_NET_ADMIN`, and it needs the esp4 or esp6 modules. Ubuntu's AppArmor restriction on unprivileged user namespaces blocks the PoC as written. The V12 README says other bugs could get around that, so do not rely on it alone. Single-user workstations and hosts with no untrusted code are lower priority, but they should still get the kernel on the next cycle.

The firewall victims are a warning about appliances. If a Linux-based device exposes a PHP or other web interface, you cannot patch its kernel yourself, so press the vendor for firmware with both fixes.

## What to do now

1. Inventory kernels: `uname -r`, then compare against your distribution's fixed package (`apt list --installed 'linux-image*'`, `rpm -q kernel`).
2. Install the fixed kernel and reboot into it: `apt-get update && apt-get install --only-upgrade 'linux-image*'` or `dnf update kernel`. A package install alone does not patch the running kernel.
3. On hosts exposed to PHP2Shell, run the checks below *before* rebooting.
4. Without IPsec, apply Red Hat's module block: `printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf`, then `rmmod esp4 esp6`. V12 also blocks `rxrpc`.
5. With IPsec, Red Hat's alternative is `echo "user.max_user_namespaces=0" > /etc/sysctl.d/dirtyfrag.conf` followed by `sysctl --system`. This breaks rootless containers, Flatpak and some browser sandboxes.
6. Patch PHP2Shell as well, so attackers lose the foothold this exploit builds on.

## How to tell if you were hit

The tampering lives in the page cache, so a reboot or `echo 3 > /proc/sys/vm/drop_caches` removes the evidence along with the backdoor. Check first. Normal reads see the modified cache, so `rpm -V util-linux pam`, `debsums -c` or `dpkg --verify` should flag a tampered `/usr/bin/su` or `/etc/pam.d/su`. Also run `grep pam_permit /etc/pam.d/su`. Look for esp4 or esp6 loaded on hosts that never use IPsec, and for `su` or root shells descended from web server users. Dream's persistence survives a reboot, so look for new systemd units, `/etc/rc.local` edits, outbound SSH tunnels and small PHP files in web-readable paths. Dream published no IP addresses or hashes.

## Timeline

- May 13, 2026 — V12 discloses Fragnesia on oss-security with a public exploit. The CVE ID is reserved.
- May 21, 2026 — The fix is merged into the netdev tree, according to [HOL](https://hol.org/guard/security/campaigns/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root).
- May 23, 2026 — The CVE record is published, listing fixed stable kernels.
- Oct 8, 2026 — Dream's attacker begins setup and exploit development.
- Oct 23, 2026 — The first government-affiliated firewall is rooted through the PHP2Shell and Fragnesia chain.
- Oct 26, 2026 — Dream Research publishes its report.
- Oct 28, 2026 — CISA adds CVE-2026-46300 to KEV, with an Oct 31 deadline.

## Sources

1. [CISA — Known Exploited Vulnerabilities: CVE-2026-46300](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300)
2. [CISA — CISA adds two known exploited vulnerabilities to catalog (Oct 28, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)
3. [CVE record — CVE-2026-46300](https://www.cve.org/CVERecord?id=CVE-2026-46300)
4. [oss-security — Fragnesia disclosure (May 13, 2026)](https://www.openwall.com/lists/oss-security/2026/05/13/5)
5. [Linux kernel — net: skbuff: preserve shared-frag marker during coalescing](https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3)
6. [V12 Security — Fragnesia proof of concept](https://github.com/v12-security/pocs/tree/main/fragnesia)
7. [Red Hat — CVE-2026-46300](https://access.redhat.com/security/cve/CVE-2026-46300)
8. [Red Hat — RHSB-2026-003: Dirty Frag and Fragnesia](https://access.redhat.com/security/vulnerabilities/RHSB-2026-003)
9. [Ubuntu — CVE-2026-46300](https://ubuntu.com/security/CVE-2026-46300)
10. [Debian security tracker — CVE-2026-46300](https://security-tracker.debian.org/tracker/CVE-2026-46300)
11. [Dream Research — Chained PHP2Shell exploit roots 25 servers](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers)
12. [Tenable — Fragnesia (CVE-2026-46300) FAQ](https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc)
13. [Rapid7 — Fragnesia LPE Metasploit module](https://www.rapid7.com/db/modules/exploit/linux/local/cve_2026_46300_fragnesia/)
14. [HOL — Fragnesia campaign record](https://hol.org/guard/security/campaigns/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root)

---
Source page: https://erroneo.us/security/briefs/fragnesia-linux-kernel-lpe-cve-2026-46300/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt