CVE-2026-46300
Fragnesia: Linux kernel ESP-in-TCP flaw gives local users root (CVE-2026-46300)
A Linux kernel bug in socket-buffer coalescing lets a local, low-privileged user write into the page cache and become root. It is known as Fragnesia, a Dirty Frag-class flaw. It was disclosed with a public exploit on 13 May 2026 and fixed upstream and by the main distros in May. CISA added it to KEV on 28 October 2026, linking it to PHP2Shell attacks on PAN-OS. CVSS 7.8.
By ThreatWire Desk · Published 23 May 2026 · Updated 31 Oct 2026
- CVSS
- 7.8
- Vector
- CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
- Class
- LPE
- Status
- Active Exploitation
- KEV
- Listed in CISA KEV
- 0-day
- No
- Vendor
- Linux kernel
- Products
- Linux kernel (net/core skbuff, ESP-in-TCP / espintcp)
- Affected
- Kernels from 3.9 before the fixed stable releases below, per the kernel CNA. Ubuntu says the flaw is practically exploitable only from 5.6, when ESP-in-TCP (espintcp) was added. Embedded and appliance kernels are affected if they carry the vulnerable code and were not patched.
- Fixed
- Upstream stable 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and mainline 7.1. Debian: bullseye 5.10.257-1, bookworm 6.1.174-1, trixie 6.12.90-1. Ubuntu: 26.04 7.0.0-22.22, 25.10 6.17.0-35.35, 24.04 6.8.0-124.124, 22.04 5.15.0-181.191. Red Hat: RHEL 8, 9 and 10 errata from 20 May 2026. For PAN-OS, apply Palo Alto Networks' PHP2Shell fixes.
- Published
- 23 May 2026
- Updated
- 31 Oct 2026
The status above is the claim. Links do not upgrade it.
Update, 31 October 2026: Attackers chained PHP2Shell with this kernel flaw to get root on internet-exposed PAN-OS firewalls. Read the PAN-OS story.
CVE-2026-46300 is a Linux kernel bug nicknamed Fragnesia. A local user with low privileges can corrupt cached file data and become root. It belongs to the Dirty Frag family of page-cache write flaws.
Affected: kernels from 3.9 up to the fixed releases below, per the kernel CNA. Ubuntu says real exploitation needs 5.6 or later. Firewalls and other appliances built on Linux are affected if their vendor did not patch the kernel.
Fixed: upstream stable 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33, 7.0.10 and mainline 7.1. Debian, Ubuntu and Red Hat shipped fixes in May 2026. Check your distro tracker for the exact package. NVD's version data lists 5.10.257 as affected, while the kernel CNA lists it as fixed. We follow the kernel CNA.
Timeline: researchers disclosed the flaw with a working exploit on 13 May 2026. The CVE was assigned the same day. NVD published it on 23 May. Distro fixes followed from 20 May. CISA added it to KEV on 28 October 2026, more than five months after the fix. The federal due date is 31 October.
Why it is in KEV now: CISA's entry says the flaw can be chained with PHP2Shell, CVE-2026-109618 and CVE-2026-109619, to plant PHP webshells and run commands as root. Dream Research named CVE-2026-46300 in its report on rooted PAN-OS firewalls. Palo Alto Networks' Unit 42 confirmed the chain but does not name the kernel CVE. CISA marks ransomware use as unknown and flags the entry for forensic triage.
PoC status: public exploits have existed since May. We do not link them. The ones we reviewed give a full root shell or bundle several kernel exploits, so they are attack tools, not safe test cases.
What to do: patch the kernel and reboot. On appliances, apply the vendor's firmware fix. For PAN-OS, install the PHP2Shell fixes and keep the management interface off the internet. If you cannot patch, follow your distro's Dirty Frag guidance to block the ESP modules. Our PAN-OS story covers the attack chain.
Sources
- Repository
- Linux kernel stable fix commit f84eca581739
- CVE.org record
- NVD
- CISA KEV catalog (added 28 Oct 2026)
- oss-security disclosure, 13 May 2026
- Debian security tracker
- Ubuntu CVE page
- Red Hat CVE page
- Dream Research, Chained PHP2Shell exploit roots 25 servers (updated 29 Oct 2026)
- Unit 42 PHP2Shell threat brief (updated 29 Oct 2026)