Fragnesia: CVE-2026-46300 in the Linux kernel

Fragnesia could allow a local user on a vulnerable Linux kernel to gain root. CISA says it can be chained with the PHP2Shell flaws to run commands as root.

Reviewed 30 Oct 2026 · Written by Rising from the linked sources. This is a dated snapshot, so check the official records before acting.

What the flaw is

William Bowling of V12 Security disclosed Fragnesia on 13 May 2026, with a public proof of concept and a kernel patch, according to Tenable. NVD scores it 7.8, High, on CVSS 3.1.

The kernel's fix notes say socket buffer coalescing loses a marker that flags fragments as shared. ESP input processing can then decrypt in place data that is backed by the page cache. Tenable says this changes files in the page cache and not on disk, so a reboot or cache flush restores them.

Tenable places Fragnesia in the same class as Dirty Frag, and says the Dirty Frag kernel patches do not fix it. Ubuntu says its kernel update covers both.

Who is affected

Tenable says a local user on a vulnerable kernel can exploit it through user and network namespaces, which most distributions enable by default. V12 notes that AppArmor restricts unprivileged user namespaces by default on Ubuntu, which its published exploit depends on. On 14 May Tenable listed Amazon Linux and CloudLinux 7 as not affected, and distribution status has moved since then.

Ubuntu's table lists 14.04, 16.04 and 18.04 as not affected. On 20.04, only the 5.15 kernels were affected and the 5.4 kernels were not. In container deployments that run third-party workloads, it says the flaw may also help a container escape. Ubuntu said no proof of concept for that had been published when it wrote its post.

What to do

Install your distribution's kernel update, then reboot into it and check the running version. Ubuntu says the reboot is required. Tenable and Ubuntu both describe a temporary mitigation that disables the ESP kernel modules. Ubuntu warns that this breaks IPsec deployments that use those modules, which are common with VPN software such as strongSwan.

Exploitation so far

Tenable reported no exploitation in the wild on 14 May. CISA added the CVE to its Known Exploited Vulnerabilities catalog on 28 October, with a 31 October deadline for US federal civilian agencies, and lists ransomware use as unknown.

CISA says the flaw can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Dream Research says it found a campaign using that chain, which rooted 25 Palo Alto Networks PAN-OS firewall and management servers across the United States, Japan, Taiwan and South Korea. Unit 42 says it independently verified the attacker's tooling and confirmed the results.

Settings

Fragnesia: CVE-2026-46300 in the Linux kernel

What the flaw is

Who is affected

What to do

Exploitation so far

Official records

Further reading