On 28 October 2026 CISA added CVE-2026-46300, a Linux kernel flaw known as Fragnesia, to its catalogue of known exploited vulnerabilities. Attackers use it to gain root on a server once they have a foothold through vulnerable PHP. A fix has been available since 13 May 2026, so the main task is to check whether your kernels are current.
Vulnerability card: Fragnesia in the Linux kernel, status as of 29 October 2026.
What happened
Fragnesia is a logic flaw in the XFRM ESP-in-TCP subsystem, the part of the kernel that handles encrypted IPsec connections. When the kernel coalesces network buffer fragments, it loses the marker saying that the memory pages belong to another subsystem. ESP decryption then writes directly into page cache pages backed by read-only files. A local user with low privileges can therefore overwrite a privileged binary in memory and run it as root. This is how the flaw is described in the Red Hat security bulletin RHSB-2026-003 and in the Ubuntu advisory, which calls it a trivial local privilege escalation that may in some cases also allow a container escape.
The flaw was disclosed on 13 May 2026 by William Bowling of V12 Security, together with a public proof-of-concept exploit and a kernel patch. According to analysis by Tenable, the attack does not rely on a race condition, and the attacker obtains the network capability it needs through user and network namespaces, which are enabled on most distributions. The earlier Dirty Frag patches do not fix this variant, a separate patch is required.
What is new is confirmed exploitation. The CISA catalogue notes that Fragnesia is chained with two PHP flaws (CVE-2026-109618 and CVE-2026-109619, together known as PHP2Shell): the attacker first runs code through PHP without authentication and plants a web shell, then uses the kernel flaw to gain root and run commands with full control of the server. US federal agencies have until 31 October 2026 to remediate. We wrote about the entry point of the chain in PHP released a fix for two critical flaws and in PHP2Shell: attackers were inside the network and had password hashes and MFA secrets within two hours.
The CVSS score is 7.8, Red Hat rates the flaw as Important and Ubuntu as High. The lower rating reflects the fact that the attacker needs a local account. In the chain with PHP2Shell the attacker gets one anyway, which is why both issues are worth addressing together.
Does this affect you?
Affected systems are Linux servers running a kernel without the 13 May 2026 fix. Red Hat lists Red Hat Enterprise Linux 8, 9 and 10 as affected and has released fixes for all supported versions. Kernels also need updating in products built on them, for example OpenShift, OpenStack and RHEL CoreOS.
On Ubuntu the flaw is fixed in kernels 5.15.0-181.191 for 22.04 LTS, 6.8.0-124.124 for 24.04 LTS, 6.17.0-35.35 for 25.10 and 7.0.0-22.22 for 26.04 LTS. Ubuntu 20.04 LTS and older are not affected in the base kernel, and for the linux-hwe-5.15 kernel on 20.04 the fix 5.15.0-181.191~20.04.1 is available with Ubuntu Pro. According to the Tenable overview, AlmaLinux has patched kernels 4.18.0-553.124.2.el8_10, 5.14.0-611.54.4.el9_7 and 6.12.0-124.56.2.el10_1. Amazon Linux is not affected because it does not ship the espintcp module. For other distributions, check their vulnerability trackers.
How to find out whether this affects you:
- The command
uname -rprints the kernel version. Compare it with the patched version for your distribution. - The command
lsmodlists loaded modules. Look for esp4, esp6 and rxrpc. - For containers, the host kernel is what matters, not the container image.
The servers most at risk are those running an internet-facing PHP application and those that several people can log in to or that run third-party code.
What to do now
- Update the kernel to the patched version for your distribution and reboot the server. Without a reboot the new kernel is not running.
- If you cannot update straight away, apply the interim measure recommended by both Red Hat and Tenable: remove the esp4, esp6 and rxrpc modules and block them from loading with a file in
/etc/modprobe.d. If the server uses IPsec, it will lose those encrypted connections, so check first. - Patch PHP, because it is the entry point of the whole chain. The fixed versions are 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Restrict local access. Red Hat recommends keeping SELinux in enforcing mode, running services under an unprivileged account and narrowing the set of people and tools that can reach the server.
How to tell whether you have been compromised
Vendors have published no indicators of compromise for the kernel flaw itself. According to the Tenable analysis, the binary on disk is unchanged, only its copy in the page cache is overwritten, and a reboot or cache flush restores normal behaviour. Checking file checksums on disk will therefore not reveal this attack.
Look for the entry point and the consequences instead: unknown PHP files in web application directories, unusual requests in web server logs, new local accounts, new SSH keys and logins to system accounts. If you find signs of an intrusion, follow your incident response plan. If you do not have one, our page for organisations dealing with an incident right now will help.
No time to track this?
Tracking vulnerabilities and deciding what to fix now and what can wait is work that can be handed over. We provide security leadership as a service for organisations that have an IT team but no security team of their own: we watch for vulnerabilities in what you actually run and give specific recommendations. Details are on our security leadership page, the first consultation is free of charge and you can also reach us through the contact page.
Sources: CISA Known Exploited Vulnerabilities catalogue, CVE-2026-46300 added on 28 October 2026 · Red Hat, bulletin RHSB-2026-003, flaw description and interim measures · Red Hat, CVE-2026-46300 page, CVSS score and impact · Ubuntu, CVE-2026-46300, patched kernel versions · kernel.org, the kernel fix · NVD, CVE-2026-46300 · Tenable, Fragnesia FAQ, disclosure and interim measure