Linux Kernel Fragnesia CVE-2026-46300 in CISA KEV: Local Root Flaw Chained With PHP2Shell

On 28 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-46300, a Linux kernel flaw known as "Fragnesia", to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation. US federal civilian agencies must fix it by 31 October 2026 (CISA KEV catalog; CISA alert). The flaw lets a user who can already run code on a Linux system become root. CISA's entry says it "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root". Those two CVEs are the PHP remote code execution flaws known as PHP2Shell, which we covered in our PHP2Shell advisory.

Keep the severity in proportion. CVE-2026-46300 is rated CVSS 3.1 7.8, High, by the Linux kernel CVE team and by NVD, and Red Hat rates it Important, below its top rating, "because exploitation requires local access to the system" (NVD; Red Hat). It cannot be exploited over the network on its own: an attacker first needs a foothold, such as a local account, a container, or code running through a compromised web application. CISA has not published any detail about the attacks it is aware of beyond the PHP2Shell chain.

This is also not a new bug. It was disclosed with a public proof-of-concept exploit on 13 May 2026, and Red Hat, Ubuntu, Debian, SUSE, Amazon Linux and Oracle Linux shipped fixed kernels between mid-May and July. For most fleets, the question is whether every Linux system and appliance actually runs one of those kernels. The KEV listing is a reason to check now.

Technical Information

What the flaw is. According to the Linux kernel CVE team, when the kernel merges incoming TCP data buffers in skb_try_coalesce(), it can move memory pages that belong to a file's page cache into a buffer without keeping the "shared fragment" marker that warns later code not to write over them. The kernel's IPsec ESP code checks that marker before deciding whether it can decrypt data in place. With the marker lost, ESP can decrypt directly over page-cache-backed memory (kernel CVE announcement). CISA classifies it as a missing initialization of a variable (CWE-456).

What an attacker gets. Red Hat says the flaw is in the kernel's XFRM ESP-in-TCP subsystem and lets "a low-privileged local attacker" write arbitrary bytes into the page cache of read-only files, including sensitive system files, and so gain root by overwriting privileged binaries. No user interaction is needed (Red Hat). Ubuntu gives the issue High priority, calls it a "trivial local privilege escalation", and says it could possibly be used to escape a container (Ubuntu).

How it was found. Fragnesia was disclosed on 13 May 2026 by V12 Security, which credits William Bowling with the discovery, together with a public proof-of-concept exploit. The disclosure, quoted on the oss-security mailing list, says the technique changes only the in-memory copy of a file: "the on-disk binary is untouched." Linux stable maintainer Greg Kroah-Hartman said the same day that CVE-2026-46300 had been assigned (oss-security, 13 May 2026). Red Hat groups it with two earlier, related flaws disclosed on 7 May 2026 under the name "Dirty Frag" (CVE-2026-43284 and CVE-2026-43500) (Red Hat bulletin RHSB-2026-003; Ubuntu blog). We do not link to the exploit code.

How it was fixed. The fix, written by Bowling and reviewed by kernel networking developer Eric Dumazet, makes skb_try_coalesce() carry the shared-fragment marker over when it moves pages (fix commit). Kernel developer Hyunwoo Kim, who worked on the Dirty Frag fixes, wrote on 21 May that "further variants of this kind are expected" in the ESP code and recommended keeping the mitigation in place for the time being (oss-security, 21 May 2026). Ubuntu notes that Fragnesia should be fixed together with CVE-2026-43284, and that the second Fragnesia fix commit is tracked as CVE-2026-43503 (Ubuntu).

Exploitation status. CISA lists CVE-2026-46300 in KEV, with "Known to be used in ransomware campaigns" set to Unknown and forensic triage required under its Binding Operational Directive (BOD) 26-04 (CISA KEV catalog). CISA gives no victims, products, dates or attacker names.

The PHP2Shell chain, as reported by others. In a 29 October update, Palo Alto Networks' Unit 42 said PHP2Shell is being exploited against PAN-OS management interfaces exposed to the internet, that Dream Research had reported a campaign chaining PHP2Shell with a Linux kernel privilege-escalation flaw to gain root, and that Unit 42 had independently verified the attacker's tooling. Unit 42 says PAN-OS fixes for PHP2Shell "interrupt the observed exploit chain" and that customers who applied them are not affected (Unit 42; Palo Alto Networks advisory). Dream Research names the kernel flaw as CVE-2026-46300 (Dream Research). BleepingComputer reported that a CISA spokesperson could not immediately share more information (BleepingComputer). We have not verified the campaign details ourselves.

Timeline (dates in Cyprus time):

• 7 May 2026: "Dirty Frag" (CVE-2026-43284, CVE-2026-43500) disclosed [Ubuntu; Red Hat].
• 13 May 2026: Fragnesia disclosed with a public exploit; CVE-2026-46300 assigned; fix posted for review [oss-security; fix commit].
• 15 May 2026: Amazon Linux and SUSE publish first fixed kernels [Amazon Linux; SUSE].
• 20–21 May 2026: Red Hat ships fixed kernels for RHEL 8, 9 and 10 [Red Hat].
• 23 May 2026: Kernel CVE team publishes the CVE record and lists fixed stable kernels from 5.10 to 7.1 [kernel CVE announcement].
• 28 October 2026: CISA adds CVE-2026-46300 to KEV; federal due date 31 October [CISA].
• 29 October 2026: Unit 42 links PHP2Shell exploitation on PAN-OS to a kernel privilege-escalation chain [Unit 42].

Affected Product Versions

Upstream, the kernel CVE team lists the flaw as introduced in Linux 3.9 and fixed in 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and 7.1 (kernel CVE announcement). Most systems run a distribution kernel, so the distribution's status is what counts. As of 30 October 2026:

Ubuntu says the published exploits need the espintcp kernel module, which first appeared in Linux 5.6, so its older 4.15 and 5.4 kernels cannot run them. Red Hat says any of its products that rely on the RHEL kernel, including OpenShift, OpenStack Platform and Virtualization, may be affected until the underlying kernel is current (Red Hat bulletin RHSB-2026-003).

Appliances and embedded systems carry their own kernels and need a vendor firmware update. For example, Siemens lists CVE-2026-46300 in the Linux subsystem of SIMATIC S7-1500 CPU 1518(F)-4 PN/DP MFP firmware V3.1.6 and says to update to V3.1.7 or later (Siemens SSA-019113).

Workaround and Mitigation

1. Install the fixed kernel and reboot. A kernel fix does nothing until the system runs it. Check the running kernel with uname -r against the table above, not just the installed package. Red Hat (kpatch) and Amazon Linux also offer live patches for some kernels. If you build your own kernels, the kernel CVE team recommends moving to the latest stable release rather than cherry-picking the fix.
2. If you cannot patch yet, block the ESP modules. Red Hat and Ubuntu both document blocking the esp4 and esp6 modules from loading, which breaks IPsec (for example strongSwan VPNs) on that host. Red Hat suggests running lsmod | grep -E 'esp4|esp6' first to see whether IPsec is in use. Where IPsec must keep working, Red Hat's alternative is to disable unprivileged user namespaces (user.max_user_namespaces=0), which can break rootless containers, sandboxed browsers and Flatpak (Red Hat bulletin RHSB-2026-003; Ubuntu blog). Ubuntu says these mitigations are not needed once the fixed kernel is running.
3. Patch PHP, and on PAN-OS apply Palo Alto's fixes. This breaks the reported chain, because the attacker needs a foothold first. CISA asks organizations to update PHP to 8.5.12, 8.4.27, 8.3.36 or 8.2.35 (CISA PHP alert). Palo Alto lists fixed PAN-OS hotfixes and advises restricting management-interface access to trusted internal IP addresses, and Unit 42 says to remove public internet access to those interfaces immediately (Palo Alto Networks advisory; Unit 42). Patching PHP does not fix the kernel: any other foothold can still use Fragnesia, so do both.
4. Reduce local footholds. Red Hat says any hardening that limits local access helps, such as disabling SSH where it is not needed, keeping SELinux in enforcing mode, running workloads as non-root and limiting OpenShift oc debug access to trusted administrators.
5. Ask your appliance vendors. Firewalls, VPN gateways, storage and industrial devices run vendor-built Linux kernels that your own patching does not reach. Check each vendor's advisories for CVE-2026-46300 (Rescana guidance).
6. Check for compromise before you reboot. CISA marks forensic triage as required for this KEV entry under BOD 26-04. Because the disclosed technique changes files only in memory, rebooting or clearing the page cache may remove the evidence along with the change. Where a host was exposed to PHP2Shell or other untrusted code, capture what you need first (Rescana guidance).

Indicators of Compromise

CISA, the kernel CVE team and the Linux distributions have not published indicators of compromise for CVE-2026-46300.

For the PHP2Shell chain, Dream Research reports that the attacker used Fragnesia to overwrite the in-memory copy of /etc/pam.d/su so that su to root needed no password, and that the attacker left a PHP webshell running as root on compromised PAN-OS devices (at /unauth/php/change_password.php) and, on one targeted firewall, a reboot-surviving reverse SSH tunnel into the internal network launched from /usr/local/lib/.panops/ (Dream Research). Unit 42 says it verified Dream's findings. We have not verified them ourselves.

Places to look (Rescana guidance): esp4, esp6 or espintcp modules loaded on hosts that do not use IPsec; web server or PHP worker processes starting shells or calling su; unexpected root shells from service accounts; and new outbound SSH sessions from web-facing servers. Disk-based file-integrity checks may not detect a page-cache-only change.

What we will update

We will update this post if CISA publishes more detail on the attacks, if a vendor or CERT publishes indicators of compromise, if more appliance vendors list affected firmware, if a new Fragnesia or Dirty Frag variant is assigned a CVE, or if NVD or a distribution changes its score.

Sources

• Linux kernel CVE team: CVE-2026-46300 announcement: https://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-46300.mbox; stable fix commit 3599e6b3cc1a (5.10; sibling commits for other branches listed in the announcement): https://git.kernel.org/stable/c/3599e6b3cc1ada96883d496a50a210d3afbb6987
• oss-security mailing list: Fragnesia disclosure and CVE assignment, 13 May 2026: https://www.openwall.com/lists/oss-security/2026/05/13/5; fix and mitigation note, 21 May 2026: https://www.openwall.com/lists/oss-security/2026/05/21/11
• CISA: KEV entry: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300; KEV alert, 28 October 2026: https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog; PHP2Shell alert: https://www.cisa.gov/news-events/alerts/2026/10/21/critical-vulnerabilities-php-require-immediate-patching
• CVE Program and NVD:https://www.cve.org/CVERecord?id=CVE-2026-46300; https://nvd.nist.gov/vuln/detail/CVE-2026-46300
• Red Hat: CVE page: https://access.redhat.com/security/cve/CVE-2026-46300; bulletin RHSB-2026-003: https://access.redhat.com/security/vulnerabilities/RHSB-2026-003
• Ubuntu (Canonical):https://ubuntu.com/security/CVE-2026-46300; Dirty Frag mitigation blog: https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available
• Debian:https://security-tracker.debian.org/tracker/CVE-2026-46300
• SUSE:https://www.suse.com/security/cve/CVE-2026-46300.html
• Amazon Linux:https://explore.alas.aws.amazon.com/CVE-2026-46300.html
• Oracle Linux:https://linux.oracle.com/cve/CVE-2026-46300.html
• Siemens ProductCERT: SSA-019113: https://cert-portal.siemens.com/productcert/html/ssa-019113.html
• Palo Alto Networks: PHP2Shell advisory: https://security.paloaltonetworks.com/CVE-2026-109618; Unit 42 threat brief, updated 29 October 2026: https://unit42.paloaltonetworks.com/cve-2026-109618-cve-2026-109619/
• Dream Research (campaign claims; not independently verified by us):https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
• BleepingComputer: "CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks," 29 October 2026: https://www.bleepingcomputer.com/news/security/cisa-warns-of-fragnesia-linux-flaw-chained-in-php2shell-attacks/

Why this matters for your vendors

The chain CISA describes is the kind of thing that plays out inside your suppliers. A web-facing PHP application or an appliance management page gives an attacker a foothold, and a months-old kernel flaw turns it into root. The kernel fix has been available since May, so a supplier that is still exposed has a patching gap worth asking about. Appliances are the likeliest blind spot, because their kernels only change when the vendor ships firmware.

Forward this to your TPRM owner: Four short questions for key suppliers that run Linux servers or Linux-based appliances (Rescana guidance):

• Are all of your Linux servers and appliances running a kernel fixed for CVE-2026-46300, and when was that confirmed?
• Have you patched PHP2Shell (CVE-2026-109618 and CVE-2026-109619) on internet-facing systems, including PAN-OS or other appliance management interfaces?
• For appliances you run on our behalf, has each vendor confirmed a fix or a mitigation?
• Have you checked internet-facing PHP systems for signs of compromise, as CISA requires its agencies to do?

Following up with Linux-based suppliers on questions like these? We can help you track their answers alongside the rest of their security posture. Book a demo.