Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign
Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce)
CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls.
Why this severity: CVSS 7.8 High (NVD); local privilege escalation to root, actively exploited (CISA KEV, Oct 28 2026)
- Started
- May 13, 2026
Affected
- Linux kernel 5.11 up to 5.15.207, 5.16 up to 6.1.173, 6.2 up to 6.6.140, 6.7 up to 6.12.90, 6.13 up to 6.18.32, 6.19 up to 7.0.9, and 7.1-rc1 to rc4 (NVD)
- Older kernels from 3.9 are also listed as affected by NVD
Fixed in
- 5.15.208
- 6.1.174
- 6.6.141
- 6.12.91
- 6.18.33
- 7.0.10
- Distribution kernels with the fix, e.g. Red Hat errata listed on the NVD record
Timeline4
CISA adds CVE-2026-46300 (Linux Kernel Missing Initialization of a Variable Vulnerability) to the KEV catalog, based on evidence of active exploitation.
Dream Research reports a campaign that chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, 24 of them perimeter firewalls, in the US, Japan, Taiwan and South Korea.
CVE-2026-46300 is published for the fix "net: skbuff: preserve shared-frag marker during coalescing", with backports to the stable kernel branches.
Fragnesia is disclosed on the oss-security list as a universal Linux local privilege escalation exploit in the Dirty Frag class, discovered by William Bowling with the V12 team.
Advisories3
Notes & caveats
Related: the PHP2Shell incident on pwn.watch covers the PHP bugs that Dream Research saw chained with Fragnesia.
Get an email when a new major security incident drops. No spam, unsubscribe any time.
