ZeroKai
Sign up
Threats

Fragnesia (CVE-2026-46300): Linux kernel privilege escalation now on CISA KEV — remediate by 31 October

A kernel flaw that can turn an on-server foothold into root. CISA confirms active exploitation, including chaining with PHP2Shell. On Ubuntu, the real fix is a patched kernel and a reboot.

Published6 min read

Photo: Brett Sayles / Pexels

Key points for company leaders

This article reflects information available on the morning of 29 October 2026 (Japan time). Vendor statuses change quickly, so check the sources at the end for the latest.

  • What happened

    A logic flaw in Linux kernel socket-buffer coalescing can drop the shared-fragment marker (CVE-2026-46300, nicknamed Fragnesia). ESP (IPsec) decryption may then overwrite page-cache-backed data in place, enabling local privilege escalation and, in some setups, container escape. NVD rates it CVSS 7.8 (High).[1][2][3]

  • Why this week

    On 28 October 2026 CISA added this CVE to its Known Exploited Vulnerabilities (KEV) catalog with a federal due date of 31 October, and requires forensic triage. Public proofs of concept need espintcp / ESP-related modules.[4][3][1]

  • Chaining with PHP2Shell

    CISA notes this flaw can be chained with CVE-2026-109618 and CVE-2026-109619 (PHP2Shell) to implant PHP webshells and run commands as root. Reporting says a China-linked actor used that chain against internet-facing firewalls on 23–24 October and planted root PHP webshells on 24 devices.[3][5]

  • What to do today

    On Ubuntu servers, check the running kernel with `uname -r` and, if it is below the fixed version, update and reboot. If you cannot update yet, Ubuntu's mitigation blocks loading esp4 and esp6 (this can affect IPsec VPNs). The same mitigation already applied for Dirty Frag also covers Fragnesia.[2]

What Fragnesia is

According to the Ubuntu Security Team, a logic flaw in how XFRM ESP-in-TCP handles socket-buffer fragments is known as Fragnesia. A local attacker could escalate privileges or possibly escape a container. Ubuntu rates it high priority and describes it as a trivial local privilege escalation.[1]

Technically, when `skb_try_coalesce()` attaches paged fragments, the `SKBFL_SHARED_FRAG` marker can be lost. Without that marker, ESP input may decrypt shared fragments in place and unintentionally modify page-cache-backed data.[1][3]

Figure 1

From PHP2Shell to a root webshell (conceptual)

CISA and reporting describe a chain that gains code execution via an internet-facing PHP flaw, escalates to root with Fragnesia, then plants a PHP webshell for persistence.

  1. 011. Internet-facing entry

    Unauthenticated code execution on the server via PHP2Shell (CVE-2026-109618 / 109619) or similar

  2. 022. Local privilege escalation

    Fragnesia (CVE-2026-46300) elevates from a low-privilege foothold to root

  3. 033. Persistence

    Plant a root PHP webshell and continue operating

Note: We do not publish exploit code or reproduction steps. This is for understanding the chain. Sources: CISA KEV and SecurityWeek coverage of Dream's report.

Source: [3], [5]

Affected Ubuntu releases and fixed versions

Per Ubuntu's CVE page and Fragnesia blog, the standard `linux` package status is as follows. Cloud kernels (AWS, GCP, Azure, Oracle and others) and HWE kernels have their own fixed versions — check Ubuntu's tables for the full list.[1][2]

Figure 2

Fixed Ubuntu kernels (linux package)

Fixed in 6.8.0-124.124 on 24.04 LTS (noble), 5.15.0-181.191 on 22.04 LTS (jammy), 6.17.0-35.35 on 25.10 (questing), and 7.0.0-22.22 on 26.04 LTS (resolute). Standard 5.4-era kernels on 20.04 and older are not affected in practice.

Fixed Ubuntu kernels (linux package)
Fixed (linux)StatusWatch out for
26.04 LTS resolute7.0.0-22.22Fixed package availableUpdate and reboot
25.10 questing6.17.0-35.35Fixed package availableUpdate and reboot
24.04 LTS noble6.8.0-124.124Fixed package availableHWE 6.17 line: 6.17.0-35.35~
22.04 LTS jammy5.15.0-181.191Fixed package availableHWE 6.8 line: 6.8.0-124.124~
20.04 LTS focal (5.4)—Standard 5.4 not affectedOnly HWE 5.15 needs a check
18.04 and older—Not affectedModule required by PoCs absent

Note: From Ubuntu's CVE page and Fragnesia blog, checked on the morning of 29 October 2026. Ubuntu notes that PoCs need the espintcp module, which appeared upstream in November 2019 (v5.6), so older kernels are not affected in practice.

Source: [1], [2]

Timeline

Figure 3

From disclosure to KEV listing

Fragnesia was disclosed and fixed in May 2026; PHP2Shell-chained attacks were reported in late October; CISA added it to KEV on 28 October.

  • Ubuntu and kernel
  • Attack sightings
  • Government agencies

  1. 13 May 2026 · Ubuntu and kernel

    Fragnesia publicly disclosed

    Ubuntu publishes mitigation blog

  2. 23 May 2026 · Ubuntu and kernel

    NVD / Ubuntu CVE publication date

    CVE-2026-46300

  3. 21 Oct 2026 · Ubuntu and kernel

    PHP2Shell fixed releases published

    CVE-2026-109618 / 109619

  4. 23–24 Oct 2026 · Attack sightings

    Chained attacks on firewalls

    Reporting: root webshells on 24 devices

  5. 28 Oct 2026 · Government agencies

    CISA adds CVE to KEV

    Due 2026-10-31; forensic triage required

  6. 29 Oct 2026 · Government agencies

    As of this article's check

    Ubuntu VPS and shared hosts in Japan should verify this week

Note: Dates are as printed in each announcement. The NVD publication date follows Ubuntu's CVE page (23 May 2026).

Source: [2], [1], [4], [3], [5]

How to check and remediate

Figure 4

From check to reboot on Ubuntu servers

Check the running kernel; if it is below the fixed version, apt-update and reboot. Only if you cannot update yet, consider the module-blocking mitigation.

  1. Check the running kernel

    Run `uname -r` and `dpkg -l 'linux-image*' | grep ^ii`, then compare with the fixed versions above

    Already on a fixed version

    If you have already rebooted, the kernel side is done. Still verify PHP2Shell patches separately

    Yes

  2. Install the fixed kernel

    `sudo apt update && sudo apt upgrade` (or a targeted linux-meta upgrade), then `sudo reboot`

    Yes

  3. Confirm again after reboot

    Record that `uname -r` is at or above the fixed version. While unpatched, blocking esp4/esp6 remains an option

Note: Steps follow Ubuntu's official blog. If you use IPsec (for example StrongSwan), the mitigation can affect VPN functionality.

Source: [2]

  1. List Ubuntu VPS, shared hosting and cloud instances run by you and your contractors
  2. On each, capture `uname -r` and compare with the fixed versions
  3. If unpatched, update, reboot, and record the post-reboot `uname -r`
  4. On hosts running PHP, also confirm PHP2Shell fixed releases
  5. List internet-facing admin and staging hostnames and ask contractors for kernel and PHP status

What it means for Ubuntu VPS and shared hosting in Japan

Many Japanese companies run websites and internal tools on Ubuntu VPS or shared hosting in Japan. Fragnesia escalates privileges after an attacker is already on the server, so risk rises sharply when PHP or a CMS is exposed — especially alongside PHP2Shell. CISA's due date is for US federal agencies, but confirmed exploitation is a priority signal for Japanese operators too.[3][5]

FAQ

Printable checklist

  • Listed Ubuntu servers (VPS, shared, cloud) run by us and our contractors
  • Captured `uname -r` on each host and compared it with Ubuntu's fixed versions
  • Installed the kernel update on unpatched hosts and recorded the post-reboot version
  • Where update must wait, considered module-blocking mitigation after checking IPsec impact
  • On PHP hosts, also confirmed PHP2Shell fixed releases
  • Asked the hosting/VPS provider for kernel and reboot status
  • Assigned an owner and deadline to look for suspicious webshells and accounts

How ZeroKai can help

Before you patch kernels, you need a list of which hosts are visible from the internet. ZeroKai takes your domain, lists host names from Certificate Transparency logs and highlights names that look like admin screens or test environments. For ownership-verified domains it also shows exposed services observed by Shodan, and the console lets you browse CISA's KEV catalog.

Sources

Numbers in [brackets] in the text refer to these sources. Links checked on 13 October 2026.

  1. [1]Ubuntu, CVE-2026-46300, 23 May 2026
  2. [2]Ubuntu, Fragnesia Linux kernel local privilege escalation vulnerability mitigations, 14 May 2026
  3. [3]US CISA, Known Exploited Vulnerabilities Catalog — CVE-2026-46300, 28 October 2026
  4. [4]US CISA, CISA Adds Two Known Exploited Vulnerabilities to Catalog, 28 October 2026
  5. [5]SecurityWeek, China-Linked Hackers Exploit PHP2Shell to Root Firewalls, 28 October 2026
  6. [6]NVD, CVE-2026-46300, 23 May 2026

Terms and questions from this article

Related articles

Before you ask your host about kernels, list the hosts you expose

Enter your domain and create an account to start a free passive assessment right away. It is free for one ownership-verified domain, and ZeroKai never contacts your servers.

After you create an account, you can start an assessment right away.

Newsletter

Japan-focused cybersecurity news that could affect companies like yours, in plain language. Twice a week, Mondays and Wednesdays.

No spam. Unsubscribe anytime. Privacy Policy