Fragnesia CVE-2026-46300, a Linux kernel flaw, landed on CISA's Known Exploited Vulnerabilities catalog on Wednesday, October 28, after attackers were seen using it to gain root on servers. Federal civilian agencies have until Saturday, October 31, to patch or mitigate it. Attackers reportedly paired the bug with the PHP2Shell web exploit, including against a system on a US government-affiliated network.
The weekend deadline gets the attention, but the exposure runs wider. Private companies, hosting providers and cloud customers running Linux face the same local root risk, and none of them has a mandatory date. If you operate Linux servers, treat this as a patch-now item rather than a compliance task.
What CISA's catalog listing requires
CISA announced the addition in an October 28 alert, and the listing cites evidence of active exploitation. It sets an October 31 remediation date. Secondary write-ups of the entry add that federal teams must perform forensic triage under Binding Operational Directive 26-04 before patching counts as sufficient, so an update alone does not close the job.
BOD 26-04 binds only Federal Civilian Executive Branch agencies. CISA encourages every other organization to follow its KEV priorities, but no directive forces a private company to act by a set date. The catalog marks ransomware use as "Unknown," so whether criminal groups have adopted Fragnesia remains an open question.
How Fragnesia turns a local foothold into root
The flaw sits in the Linux kernel's XFRM ESP-in-TCP subsystem. A low-privileged local user can write arbitrary bytes into the page cache of read-only files, such as /usr/bin/su, then gain root, according to Tenable's FAQ. Because an attacker needs local access first, Red Hat rates the flaw Important rather than Critical, as its CVE record shows.
Researchers at V12 disclosed the bug on May 13, 2026, and published a working proof-of-concept at the same time, per SOCPrime's write-up. That means defenders have had public exploit code for months, and the KEV listing confirms that the code has moved from research into real attacks.
The scoring picture is mixed. CVSS v3.1 rates the flaw 7.8, High, per Strix. EPSS, which estimates the chance a flaw will be exploited, gives conflicting numbers: Strix lists 9.48%, while a Spanish-language KEV tracker lists 10.19% at the 96th percentile. The gap does not change the advice, because the KEV listing already reflects observed exploitation.
Where the PHP2Shell link stands
Attackers reportedly chained a custom PHP2Shell exploit with Fragnesia to gain root on 25 servers, mostly firewall appliances, including systems on a US government-affiliated network. That account comes from a Dream report as summarized by HOL Guard. USA 24 could not verify the report independently.
A Rescana write-up says a Unit 42 analysis links PHP2Shell exploitation on PAN-OS, the operating system for Palo Alto Networks firewalls, to a kernel privilege-escalation chain. That is a secondhand description of the research, and independent telemetry has not confirmed the link. USA 24 covers the web-exploit side separately in our PHP2Shell report. This story focuses on the kernel component attackers reportedly paired with it.
Which Linux servers need the Fragnesia CVE-2026-46300 fix
OpenCVE's affected-version data covers kernels from 3.9 through 5.10.257 and 5.11 through 5.15.207, plus other ranges up to 7.1 RC4, per its CVE page. Do not rely on the major version alone. Enterprise distributions backport fixes into kernels that keep older version strings, so the package version and your vendor's advisory matter more. One source says upstream fixed the flaw in stable kernel 7.0.10.
For Red Hat systems, a third-party table in the Rescana write-up lists fixed kernels that shipped May 20, 2026:
| Release | Fixed kernel |
|---|---|
| RHEL 8 | 4.18.0-553.125.1.el8_10 |
| RHEL 9 | 5.14.0-687.10.1.el9_8 |
| RHEL 10 | 6.12.0-211.16.1.el10_2 |
Check these numbers against Red Hat's advisory before deploying, since they come from a secondary table.
Earlier kernel fixes do not cover this bug. Tenable reports that existing patches for Dirty Frag do not fix Fragnesia, so teams that assumed they were covered need to verify again. Appliance owners face a harder problem. The sources reviewed do not say which firewall or appliance vendors shipped affected kernels, or whether every vendor has released a fix, so open a support ticket with each vendor now.
Steps to take before the weekend ends
- Check for compromise before rebooting. Look at /usr/bin/su and /etc/pam.d/su, because reports describe overwritten PAM configuration. Compare both files against your package manager, using rpm -V on Red Hat-family systems or debsums on Debian and Ubuntu.
- Patch and confirm. Check your distribution's advisory, install the patched kernel for your release, reboot, and confirm the running version with uname -r.
- Use the stopgap only with network sign-off. Where patches are not yet installed, one public mitigation guide advises unloading or blacklisting the esp4, esp6 and rxrpc modules. Unloading them may break IPsec VPNs, so confirm with your network team before you touch them.
Why this pattern matters beyond one federal deadline
Fragnesia follows a run of Linux local privilege-escalation bugs. Dirty Frag came first, and Copy Fail (CVE-2026-31431) reached the KEV catalog on May 1, according to its Wikipedia entry. In September, CISA added three other Linux kernel bugs under the same directive, per Aviatrix. USA 24 has also reported on a separate Linux kernel TCP flaw that Anthropic said an unreleased Claude model had turned into a root exploit, in our coverage of CVE-2026-98432.
Local root bugs act as a second stage. They need a foothold, and web exploits such as PHP2Shell can supply one. Teams that rank vulnerabilities by remote exposure alone may push a local flaw to the bottom of the queue, and that ranking breaks down once the first stage is already in use.
Attackers gain a way to turn a web shell into full control of a server. Hosting providers and their customers absorb the cleanup, and appliance owners depend on firmware schedules they do not control.
What to watch next
Four open questions will decide how urgent this gets. The first is whether independent telemetry confirms the Dream and Unit 42 reports that tie PHP2Shell to the kernel flaw. The second is which firewall and appliance vendors shipped affected kernels, and whether all of them have fixes. The third is whether CISA extends or changes the October 31 deadline, which has not been reported. The fourth is whether ransomware groups adopt the exploit. Trackers may also reconcile the conflicting EPSS figures as their data updates.
The next few days will show whether federal agencies meet the deadline and whether appliance vendors publish firmware quickly enough for private operators to follow. If your team has not yet listed which kernels run in production, make that inventory the first task on Monday, and treat the exposure as real until your vendor says otherwise.
