# Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign · pwn.watch > CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls. Page: https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev · generated 2026-10-28T22:05:28.248Z ## Status - Severity: high · status: live · patch: patched - Product: Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce) - Started: 2026-05-13 - CVEs: CVE-2026-46300 - Affected: Linux kernel 5.11 up to 5.15.207, 5.16 up to 6.1.173, 6.2 up to 6.6.140, 6.7 up to 6.12.90, 6.13 up to 6.18.32, 6.19 up to 7.0.9, and 7.1-rc1 to rc4 (NVD); Older kernels from 3.9 are also listed as affected by NVD - Fixed in: 5.15.208; 6.1.174; 6.6.141; 6.12.91; 6.18.33; 7.0.10; Distribution kernels with the fix, e.g. Red Hat errata listed on the NVD record ## Follow this incident - RSS (one item per update): https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev/feed.xml - JSON Feed: https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev/feed.json - Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev.json - This file: https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev/llms.txt ## Updates (newest first) - 2026-10-28: CISA adds CVE-2026-46300 (Linux Kernel Missing Initialization of a Variable Vulnerability) to the KEV catalog, based on evidence of active exploitation. (https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) - 2026-10-27: Dream Research reports a campaign that chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, 24 of them perimeter firewalls, in the US, Japan, Taiwan and South Korea. (https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) - 2026-05-23: CVE-2026-46300 is published for the fix "net: skbuff: preserve shared-frag marker during coalescing", with backports to the stable kernel branches. (https://nvd.nist.gov/vuln/detail/CVE-2026-46300) - 2026-05-13: Fragnesia is disclosed on the oss-security list as a universal Linux local privilege escalation exploit in the Dirty Frag class, discovered by William Bowling with the V12 team. (https://www.openwall.com/lists/oss-security/2026/05/13/5) ## Fix brief # Security brief: Linux kernel Fragnesia root exploit (CVE-2026-46300) added to CISA KEV, already used in a PHP2Shell firewall campaign Source: https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev · status: live · severity: high · updated Oct 28, 2026, 20:47 UTC ## Patch status **PATCHED: fixed releases exist. Upgrade to a fixed version.** ## What it is CISA added CVE-2026-46300, the Linux kernel local privilege escalation known as Fragnesia, to its Known Exploited Vulnerabilities catalog on Oct 28 based on evidence of active exploitation. The bug is in skb_try_coalesce(), which loses the shared-frag marker when TCP receive coalescing moves paged frags, so IPsec ESP-in-TCP input can decrypt in place over page-cache-backed pages. A low-privileged local user can use it to write bytes into read-only files such as system binaries and gain root. Fragnesia was disclosed on oss-security on May 13 2026 as a Dirty Frag class exploit found by William Bowling with the V12 team, and fixed stable kernels have been out since then. On Oct 27 Dream Research reported a campaign that chained a PHP2Shell exploit with Fragnesia to root 25 servers, including 24 perimeter firewalls. Severity detail: CVSS 7.8 High (NVD); local privilege escalation to root, actively exploited (CISA KEV, Oct 28 2026) - Product: Linux kernel (IPsec ESP-in-TCP receive path, skb_try_coalesce) - CVE / advisory ids: CVE-2026-46300 ## Affected versions - Linux kernel 5.11 up to 5.15.207, 5.16 up to 6.1.173, 6.2 up to 6.6.140, 6.7 up to 6.12.90, 6.13 up to 6.18.32, 6.19 up to 7.0.9, and 7.1-rc1 to rc4 (NVD) - Older kernels from 3.9 are also listed as affected by NVD ## Check whether you're affected Run these where the product is installed or in the project that depends on it, then compare with the affected/fixed versions: ```sh uname -r ``` ## Fix Upgrade to one of these fixed versions (or later on the same branch): - 5.15.208 - 6.1.174 - 6.6.141 - 6.12.91 - 6.18.33 - 7.0.10 - Distribution kernels with the fix, e.g. Red Hat errata listed on the NVD record After upgrading, re-run the checks above and redeploy/restart the affected services. ## Specific notes Check the running kernel with uname -r and update to a fixed stable kernel (5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 or later) or your distribution's patched kernel, then reboot. Prioritize internet-facing hosts and appliances where an attacker could first get a low-privileged foothold, such as servers running PHP. ## Latest updates - Oct 28, 2026: CISA adds CVE-2026-46300 (Linux Kernel Missing Initialization of a Variable Vulnerability) to the KEV catalog, based on evidence of active exploitation. - Oct 27, 2026: Dream Research reports a campaign that chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, 24 of them perimeter firewalls, in the US, Japan, Taiwan and South Korea. - May 23, 2026: CVE-2026-46300 is published for the fix "net: skbuff: preserve shared-frag marker during coalescing", with backports to the stable kernel branches. - May 13, 2026: Fragnesia is disclosed on the oss-security list as a universal Linux local privilege escalation exploit in the Dirty Frag class, discovered by William Bowling with the V12 team. ## Advisories - [CISA Adds Two Known Exploited Vulnerabilities to Catalog](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog) (CISA) - [CVE-2026-46300 Detail](https://nvd.nist.gov/vuln/detail/CVE-2026-46300) (NVD) - [Re: Linux kernel LPE ("fragnesia", copyfail 3.0)](https://www.openwall.com/lists/oss-security/2026/05/13/5) (oss-security) ## Write-ups & news - [Chained PHP2Shell Exploit Roots 25 Servers](https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers) ## Caveats Related: the PHP2Shell incident on pwn.watch covers the PHP bugs that Dream Research saw chained with Fragnesia. --- Machine-readable: https://pwn.watch/i/linux-fragnesia-lpe-cve-2026-46300-cisa-kev.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.