Fragnesia Linux Flaw Exploited: Check Your Kernel Version

Fragnesia, a Linux kernel flaw tracked as CVE-2026-46300, is now being used in real attacks. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalog of exploited vulnerabilities on October 28, 2026. Attackers are chaining it with the PHP2Shell flaws to move from limited access to root on web servers.

An older flaw with new attackers

Fragnesia was not discovered this week. Researcher William Bowling of V12 Security disclosed it on May 13, 2026, together with a proof of concept and a kernel patch, according to Tenable’s summary. Major distributions such as Ubuntu, Debian, and AlmaLinux shipped fixed kernels over the following days and weeks.

At the time, nobody had reported exploitation in the wild. That changed in late October. In its Known Exploited Vulnerabilities (KEV) catalog, CISA says Fragnesia can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. US federal agencies have until October 31, 2026 to apply the fix.

Ubuntu rates the flaw 7.8 on the CVSS scale, with a “High” priority. The score is lower than that of critical bugs reachable straight from the internet because Fragnesia needs local access to the server first. In a chained attack, another flaw supplies that access.

How Fragnesia works

The bug sits in the kernel’s XFRM ESP-in-TCP subsystem, which handles IPsec traffic wrapped in TCP. When the kernel merges fragments of network data, the skb_try_coalesce() function drops the marker saying a fragment is shared. As a result, ESP decryption can write directly over data that actually comes from the page cache, the in-memory copy of files on disk.

That lets an ordinary user alter files that should be read-only, such as system programs like /usr/bin/su. Tenable notes that the file on disk is never changed; only its copy in memory is, and normal behavior returns after a reboot or a cache flush. While the altered copy is live, however, the attacker can already obtain root.

Ubuntu adds that the flaw could possibly be used to escape a container. That matters for teams running many applications on one machine, since every container shares the host’s kernel. Rebuilding a container image does nothing here; the host kernel is what needs updating.

Fragnesia is often mentioned alongside Dirty Frag, a similar flaw disclosed on May 7, 2026. Tenable stresses that the kernel patches for Dirty Frag do not fix Fragnesia. Servers that only received the Dirty Frag patch still need a newer kernel.

The PHP2Shell and Fragnesia attack chain

PHP2Shell is the name given to two critical PHP flaws patched on October 21, 2026, which we covered in PHP2Shell and the safe PHP versions. They let an attacker run code remotely without an account, but usually only with the privileges of the web server user, such as www-data.

Fragnesia supplies the next step. From a low-privilege webshell, the attacker uses the kernel flaw to become root. From there they can read every file, install a backdoor, or move to other systems on the same network.

BleepingComputer reported, citing findings from security firm Dream Security, that the two flaws were combined to breach 25 servers. According to Unite.AI, that total consists of 24 perimeter firewalls and one internal management server, including systems in a US government-affiliated environment. Dream did not name the affected vendor or software versions and said it had notified the vendor.

The same report says the attackers extracted an LDAP service-account credential and enumerated the directory. Dream could not confirm whether follow-up steps, such as creating backdoor accounts, succeeded. CISA has not shared details about the ongoing attacks.

Kernel versions that fix the flaw

Fixes for Fragnesia have been available since May 2026, so servers that are patched regularly are probably safe. The risk lies with servers that are rarely rebooted: the new kernel is installed, but the old one is still running. These are the minimum versions listed by each distribution’s official security tracker.

• Ubuntu (Ubuntu CVE page): 26.04 LTS is fixed in 7.0.0-22.22, 24.04 LTS in 6.8.0-124.124, and 22.04 LTS in 5.15.0-181.191. The standard kernels in Ubuntu 20.04 LTS and older are not affected.
• Debian (Debian security tracker): Debian 12 (bookworm) is fixed in 6.1.174-1 via DSA-6306-1, and Debian 13 (trixie) in 6.12.90-1 via DSA-6295-1. Debian 11 (bullseye) received 5.10.257-1 via DLA-4606-1.
• AlmaLinux (AlmaLinux announcement): version 8 needs kernel-4.18.0-553.124.3.el8_10, version 9 needs kernel-5.14.0-611.54.5.el9_7, and version 10 needs kernel-6.12.0-124.56.3.el10_1 or later.

For other distributions, including Red Hat Enterprise Linux and its derivatives, use the versions in your vendor’s official advisory. Tenable notes that Amazon Linux is not affected because it does not ship the espintcp module.

What this means for server administrators and hosting providers

In Indonesia, many school, local government, and small business websites run on Linux servers with PHP, either on their own VPS or on shared hosting. On a shared server, one site breached through PHP2Shell can become a path to root, and from there to every other site on the machine. Both flaws should be handled together.

1. Check the running kernel. Run uname -r and compare the result with the versions above. On Ubuntu and Debian, dpkg -l 'linux-image*' | grep ^ii lists the installed kernels. If the two differ, the server has not been rebooted.
2. Update the kernel and reboot. The fix only takes effect after a reboot. Ubuntu notes that unattended-upgrades can install the update automatically, but a reboot is still required. Schedule a short maintenance window if the server has active users.
3. Block the modules if you cannot update yet. Ubuntu and AlmaLinux recommend a temporary mitigation that stops the esp4, esp6, and rxrpc modules from loading. This breaks services that rely on IPsec ESP or AFS, so check first. Servers that already applied the Dirty Frag mitigation are covered.
4. Close the entry point and look for traces. Update PHP to 8.5.12, 8.4.27, 8.3.36, or 8.2.35. Unite.AI cites AWS guidance to search for PHP2Shell activity going back at least to October 17, 2026. Look for unknown PHP files in site folders, new accounts, and suspicious processes running as root.

If you suspect a server was compromised before the mitigation was in place, AlmaLinux advises dropping the page cache so that altered copies of programs in memory are discarded. That step does not remove any backdoor that may already be installed, so a full review is still needed.

Appliances such as firewalls, NAS units, and other Linux-based network devices cannot be updated the same way. For these, follow the vendor’s official firmware and restrict the management interface to the internal network, since the attacks Dream reported started from an exposed management interface.

Teams that run many servers can add the kernel version to routine monitoring, so machines that fall behind on updates stand out immediately. This is part of what Merakit covers in its cybersecurity services and in infrastructure management under its cloud computing services.

Frequently asked questions

Can Fragnesia be exploited directly from the internet?

Not directly. Fragnesia requires local access, such as an ordinary user account or a webshell. The risk rises because other flaws, PHP2Shell among them, can provide that initial access from the internet.

I already patched Dirty Frag. Is that enough?

No. According to Tenable, the kernel patches for Dirty Frag do not fix Fragnesia. The exception is a server that blocked the esp4, esp6, and rxrpc modules as a Dirty Frag mitigation; that mitigation also protects against Fragnesia.

Are Docker containers affected?

Containers use the host kernel, so exposure depends on the kernel running on the host machine. Ubuntu says the flaw could possibly be used to escape a container. Update and reboot the host; rebuilding container images alone is not enough.

Closing thoughts

Fragnesia shows how a flaw rated “High” can become serious once it is chained with another one. Fixes have been available since May, so the most important step now is to confirm that the new kernel is actually running on every server, and then to close the PHP flaws that serve as the entry point. If your team needs help checking and updating its servers, the Merakit team is ready to assist.

Sources

• CISA: Known Exploited Vulnerabilities Catalog (CVE-2026-46300, added October 28, 2026)
• BleepingComputer: CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks (October 29, 2026)
• Unite.AI: Dream reports PHP2Shell attack chain that compromised 25 servers (October 27, 2026)
• Tenable: Fragnesia (CVE-2026-46300) FAQ (May 14, 2026)
• Ubuntu: CVE-2026-46300 (updated October 29, 2026)
• Ubuntu: Dirty Frag Linux vulnerability fixes available (May 8, 2026)
• Debian Security Tracker: CVE-2026-46300
• AlmaLinux: Fragnesia (CVE-2026-46300) Patches Released (May 13, 2026)