May 13, 2026
1 new incident, 0 with updates.
Started
- LivePatched
Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign
CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls.
Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce)Since May 13, 2026
