# Fragnesia Linux Flaw Lands in CISA KEV Ahead of Saturday Deadline

- URL: https://usa-24.com/fragnesia-cve-2026-46300-linux-patch/
- Publisher: USA 24
- Section: Cybersecurity
- Published: 2026-10-30T20:01:36.484Z
- Updated: 2026-10-30T20:01:36.493Z
- Topics: Linux Security, CISA KEV, Privilege Escalation, Vulnerability Management, PHP2Shell

> CISA's Known Exploited Vulnerabilities list now includes a Linux kernel root flaw that attackers paired with PHP2Shell, with a federal fix deadline of Saturday, Oct. 31.

## Key takeaways

- CISA added CVE-2026-46300 (Fragnesia) to its Known Exploited Vulnerabilities catalog on October 28, 2026, with a federal remediation date of October 31.
- The Linux kernel flaw lets a low-privileged local user write bytes into the page cache of read-only files such as /usr/bin/su and then gain root.
- CVSS v3.1 scores the flaw 7.8 (High), and Red Hat rates it Important because exploitation requires local access.
- Reports say attackers paired Fragnesia with the PHP2Shell web exploit to root 25 servers, but USA 24 could not independently verify that account.
- Red Hat shipped fixes for RHEL 8, 9 and 10 on May 20, 2026, and earlier Dirty Frag kernel patches do not cover Fragnesia.

Fragnesia CVE-2026-46300, a Linux kernel flaw, landed on CISA's Known Exploited Vulnerabilities catalog on Wednesday, October 28, after attackers were seen using it to gain root on servers. Federal civilian agencies have until Saturday, October 31, to patch or mitigate it. Attackers reportedly paired the bug with the PHP2Shell web exploit, including against a system on a US government-affiliated network.

The weekend deadline gets the attention, but the exposure runs wider. Private companies, hosting providers and cloud customers running Linux face the same local root risk, and none of them has a mandatory date. If you operate Linux servers, treat this as a patch-now item rather than a compliance task.

## What CISA's catalog listing requires

CISA announced the addition in an [October 28 alert](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog), and the listing cites evidence of active exploitation. It sets an October 31 remediation date. Secondary write-ups of the entry add that federal teams must perform forensic triage under Binding Operational Directive 26-04 before patching counts as sufficient, so an update alone does not close the job.

BOD 26-04 binds only Federal Civilian Executive Branch agencies. CISA encourages every other organization to follow its KEV priorities, but no directive forces a private company to act by a set date. The catalog marks ransomware use as "Unknown," so whether criminal groups have adopted Fragnesia remains an open question.

## How Fragnesia turns a local foothold into root

The flaw sits in the Linux kernel's XFRM ESP-in-TCP subsystem. A low-privileged local user can write arbitrary bytes into the page cache of read-only files, such as /usr/bin/su, then gain root, according to [Tenable's FAQ](https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc). Because an attacker needs local access first, Red Hat rates the flaw Important rather than Critical, as its [CVE record](https://access.redhat.com/security/cve/cve-2026-46300) shows.

Researchers at V12 disclosed the bug on May 13, 2026, and published a working proof-of-concept at the same time, per [SOCPrime's write-up](https://socprime.com/blog/cve-2026-46300-fragnesia-linux-kernel-flaw/). That means defenders have had public exploit code for months, and the KEV listing confirms that the code has moved from research into real attacks.

The scoring picture is mixed. CVSS v3.1 rates the flaw 7.8, High, per [Strix](https://www.strix.ai/cve/CVE-2026-46300). EPSS, which estimates the chance a flaw will be exploited, gives conflicting numbers: Strix lists 9.48%, while a [Spanish-language KEV tracker](https://github.com/TheWillSoldier/cyber-vulnerability-intelligente/issues/6) lists 10.19% at the 96th percentile. The gap does not change the advice, because the KEV listing already reflects observed exploitation.

## Where the PHP2Shell link stands

Attackers reportedly chained a custom PHP2Shell exploit with Fragnesia to gain root on 25 servers, mostly firewall appliances, including systems on a US government-affiliated network. That account comes from a Dream report as summarized by [HOL Guard](https://hol.org/guard/security/campaigns/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root). USA 24 could not verify the report independently.

A [Rescana write-up](https://www.rescana.com/post/linux-kernel-fragnesia-cve-2026-46300-xfrm-esp-tcp-privilege-escalation-kev) says a Unit 42 analysis links PHP2Shell exploitation on PAN-OS, the operating system for Palo Alto Networks firewalls, to a kernel privilege-escalation chain. That is a secondhand description of the research, and independent telemetry has not confirmed the link. USA 24 covers the web-exploit side separately in our [PHP2Shell report](https://usa-24.com/php2shell-vulnerability-fix/). This story focuses on the kernel component attackers reportedly paired with it.

## Which Linux servers need the Fragnesia CVE-2026-46300 fix

OpenCVE's affected-version data covers kernels from 3.9 through 5.10.257 and 5.11 through 5.15.207, plus other ranges up to 7.1 RC4, per its [CVE page](https://app.opencve.io/cve/CVE-2026-46300). Do not rely on the major version alone. Enterprise distributions backport fixes into kernels that keep older version strings, so the package version and your vendor's advisory matter more. One source says upstream fixed the flaw in stable kernel 7.0.10.

For Red Hat systems, a third-party table in the Rescana write-up lists fixed kernels that shipped May 20, 2026:

| Release | Fixed kernel |
|---|---|
| RHEL 8 | 4.18.0-553.125.1.el8_10 |
| RHEL 9 | 5.14.0-687.10.1.el9_8 |
| RHEL 10 | 6.12.0-211.16.1.el10_2 |

Check these numbers against Red Hat's advisory before deploying, since they come from a secondary table.

Earlier kernel fixes do not cover this bug. Tenable reports that existing patches for Dirty Frag do not fix Fragnesia, so teams that assumed they were covered need to verify again. Appliance owners face a harder problem. The sources reviewed do not say which firewall or appliance vendors shipped affected kernels, or whether every vendor has released a fix, so open a support ticket with each vendor now.

## Steps to take before the weekend ends

1. Check for compromise before rebooting. Look at /usr/bin/su and /etc/pam.d/su, because reports describe overwritten PAM configuration. Compare both files against your package manager, using rpm -V on Red Hat-family systems or debsums on Debian and Ubuntu.
2. Patch and confirm. Check your distribution's advisory, install the patched kernel for your release, reboot, and confirm the running version with uname -r.
3. Use the stopgap only with network sign-off. Where patches are not yet installed, one public [mitigation guide](https://github.com/0xredash/CVE-2026-46300) advises unloading or blacklisting the esp4, esp6 and rxrpc modules. Unloading them may break IPsec VPNs, so confirm with your network team before you touch them.

## Why this pattern matters beyond one federal deadline

Fragnesia follows a run of Linux local privilege-escalation bugs. Dirty Frag came first, and Copy Fail (CVE-2026-31431) reached the KEV catalog on May 1, according to its [Wikipedia entry](https://en.wikipedia.org/wiki/Copy_Fail). In September, CISA added three other Linux kernel bugs under the same directive, per [Aviatrix](https://aviatrix.ai/threat-research-center/cisa-flags-three-linux-kernel-vulnerabilities-exploited-wild-2026/). USA 24 has also reported on a separate Linux kernel TCP flaw that Anthropic said an unreleased Claude model had turned into a root exploit, in [our coverage of CVE-2026-98432](https://usa-24.com/cve-2026-98432-linux-kernel-tcp-flaw/).

Local root bugs act as a second stage. They need a foothold, and web exploits such as PHP2Shell can supply one. Teams that rank vulnerabilities by remote exposure alone may push a local flaw to the bottom of the queue, and that ranking breaks down once the first stage is already in use.

Attackers gain a way to turn a web shell into full control of a server. Hosting providers and their customers absorb the cleanup, and appliance owners depend on firmware schedules they do not control.

## What to watch next

Four open questions will decide how urgent this gets. The first is whether independent telemetry confirms the Dream and Unit 42 reports that tie PHP2Shell to the kernel flaw. The second is which firewall and appliance vendors shipped affected kernels, and whether all of them have fixes. The third is whether CISA extends or changes the October 31 deadline, which has not been reported. The fourth is whether ransomware groups adopt the exploit. Trackers may also reconcile the conflicting EPSS figures as their data updates.

The next few days will show whether federal agencies meet the deadline and whether appliance vendors publish firmware quickly enough for private operators to follow. If your team has not yet listed which kernels run in production, make that inventory the first task on Monday, and treat the exposure as real until your vendor says otherwise.

## Frequently asked questions

### Is my Linux server affected by CVE-2026-46300?

OpenCVE lists affected kernels from 3.9 through 5.10.257 and 5.11 through 5.15.207, plus other ranges up to 7.1 RC4. Because distributions backport fixes, compare your package version against your vendor's advisory rather than relying on the major kernel number. Red Hat's fixed kernels for RHEL 8, 9 and 10 are listed in this article.

### What is the CISA deadline for the Fragnesia flaw?

CISA set a federal remediation date of October 31, 2026, which falls on a Saturday. The directive, BOD 26-04, binds only Federal Civilian Executive Branch agencies. Private organizations have no mandatory deadline, though CISA encourages them to follow its KEV priorities.

### How do I check whether Fragnesia already compromised my server?

Look for modified /usr/bin/su or /etc/pam.d/su, since reports describe overwritten PAM configuration. Compare both files against your package manager, using rpm -V on Red Hat-family systems or debsums on Debian and Ubuntu. Do this before you reboot the server.

### Do earlier Dirty Frag patches protect against Fragnesia?

No. Tenable reports that existing kernel patches for Dirty Frag do not fix Fragnesia. Install the fix for CVE-2026-46300 specifically, and confirm the running kernel version after you reboot.

## Sources

1. [CISA Adds Two Known Exploited Vulnerabilities to Catalog (Oct. 28, 2026)](https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog)
2. [Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
3. [Linux Kernel Fragnesia CVE-2026-46300 in CISA KEV: Local Root Flaw Chained With PHP2Shell (Rescana)](https://www.rescana.com/post/linux-kernel-fragnesia-cve-2026-46300-xfrm-esp-tcp-privilege-escalation-kev)
4. [Fragnesia (CVE-2026-46300): a Linux kernel bug used to turn PHP2Shell web shells into root, now on CISA KEV (HOL Guard)](https://hol.org/guard/security/campaigns/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root)
5. [CVE-2026-46300 — Red Hat Customer Portal](https://access.redhat.com/security/cve/cve-2026-46300)
6. [CVE-2026-46300 (Fragnesia): Linux Kernel ESP-in-TCP LPE FAQ (Tenable)](https://www.tenable.com/blog/fragnesia-cve-2026-46300-faq-about-new-linux-kernel-xfrm-esp-in-tcp-priv-esc)
7. [CVE-2026-46300: Linux Kernel Out-of-Bounds Write (Strix)](https://www.strix.ai/cve/CVE-2026-46300)
8. [Cyber vulnerability intelligence issue #6 (GitHub, Spanish-language KEV tracker)](https://github.com/TheWillSoldier/cyber-vulnerability-intelligente/issues/6)
9. [CVE-2026-46300: Fragnesia Linux Kernel Flaw (SOCPrime)](https://socprime.com/blog/cve-2026-46300-fragnesia-linux-kernel-flaw/)
10. [Fragnesia FAQ and affected-version data (OpenCVE)](https://app.opencve.io/cve/CVE-2026-46300)
11. [Copy Fail (Wikipedia)](https://en.wikipedia.org/wiki/Copy_Fail)
12. [CISA Flags Three Linux Kernel Vulnerabilities Under Active Exploitation (Aviatrix)](https://aviatrix.ai/threat-research-center/cisa-flags-three-linux-kernel-vulnerabilities-exploited-wild-2026/)