CVE-2026-46300

What is the Linux Kernel?

The Linux kernel is the component that owns memory, scheduling, filesystems, and the network stack on effectively every cloud instance, container host, Android handset, and embedded appliance in production. Two of its subsystems matter here. The page cache holds the in-memory copy of file contents, so a read-only binary such as /usr/bin/su exists in RAM as pages that many processes share. XFRM is the kernel's IPsec framework, and its ESP-in-TCP mode encapsulates encrypted IPsec payloads inside a TCP stream so IPsec survives middleboxes that drop raw ESP.

A kernel bug that lets an unprivileged process write into the page cache is worth more than most remote code execution bugs, because it turns any foothold, a web shell included, into root on the host.

Overview

CVE-2026-46300, named Fragnesia, is a local privilege escalation in the Linux kernel's XFRM ESP-in-TCP path. When skb_try_coalesce() merges paged fragments from one socket buffer into another, it fails to carry the SKBFL_SHARED_FRAG marker across. That marker is what tells the rest of the stack that the pages behind the fragment are shared with another subsystem and must not be written to. Without it, ESP input processing believes the buffer is private and decrypts in place, over pages that actually belong to the page cache.

The result is an arbitrary write into cached file contents. The disk is never touched, so integrity tooling that hashes files on disk sees nothing, and a reboot or a page cache drop silently restores the original bytes along with the evidence. Attack complexity is low and no race window is involved.

CISA labels the flaw a missing initialization of a variable, which describes the lost marker. NVD assigns CWE-787, out-of-bounds write, which describes the consequence. Both are fair. The distinguishing detail is that Fragnesia survives the earlier Dirty Frag fixes: Dirty Frag discoverer Hyunwoo Kim stated that Fragnesia was accidentally activated by the patch for CVE-2026-43284, so a host patched for Dirty Frag and nothing else is still exposed.

Affected Versions

Amazon Linux and CloudLinux 7 are reported as not affected. Red Hat Enterprise Linux, Debian, openSUSE, CentOS Stream, and Gentoo were all vulnerable at disclosure and have since shipped kernels; check your own distribution tracker rather than this table for a definitive build number.

Technical Details

The defect is a one-line omission in skb_try_coalesce(). The helper moves paged fragments from a source socket buffer into a destination buffer to reduce memory overhead, but it copies the fragment array without copying the source buffer's SKBFL_SHARED_FRAG flag. Later, skb_has_shared_frag() returns false for the merged buffer, and ESP input takes the in-place decryption path instead of making a private copy.

Reaching that path is the clever part. The exploit splices a target file into a TCP socket's receive queue, so the queued fragments are page cache pages, then switches the socket into espintcp ULP mode. The kernel now treats those file pages as ESP ciphertext and XORs the AES-GCM keystream over them, giving a controlled 192-byte write per operation. Dirty Frag, by contrast, achieved only a 4-byte store through the plain xfrm-ESP path.

No authentication beyond local shell access is needed, and no privileges: the public proof of concept creates unprivileged user and network namespaces to obtain CAP_NET_ADMIN inside them, which is enough to configure the XFRM state. It targets /usr/bin/su in the page cache, but Microsoft noted the technique applies to any user-readable file, /etc/passwd included. Containers are in scope both as a source of attack and as something to escape from.

Discovery

Fragnesia was found and disclosed by William Bowling on 2026-05-13, with a write-up, a working proof of concept, and a kernel patch published together. Bowling's affiliation is reported inconsistently: Tenable names V12 Security, Help Net Security names Zellic, and the proof of concept sits in the v12-security GitHub organisation. Help Net Security reports the bug was surfaced with an AI-assisted code auditing tool.

The work builds directly on Dirty Frag (CVE-2026-43284 and CVE-2026-43500) by Hyunwoo Kim, and a third variant, DirtyDecrypt or DirtyCBC, was patched days later on 2026-05-18.

Exploitation Context

For five months Fragnesia had a public exploit and no observed in-the-wild use. That changed when PHP2Shell shipped. Security firm Dream reports that a Chinese-nexus operator used the FOFA search engine to enumerate roughly 19,000 internet-facing firewall appliances from one unnamed vendor, filtered to the United States, Japan, Taiwan, and South Korea and to builds running newer PHP releases, leaving about 240 candidates. On 2026-10-23 and 2026-10-24 the operator exploited 25 of them, chaining the PHP2Shell pair CVE-2026-109618 and CVE-2026-109619 for unauthenticated code execution as the PHP process, then Fragnesia to reach root. A PHP root web shell landed on 24 of the 25.

On 22 appliances no further activity followed. At one United States government-affiliated organisation the operator went further, opening a reverse SSH tunnel to an internal firewall management server, reading configurations and credentials for every firewall that organisation managed, decrypting an LDAP service account password, enumerating domain users and groups, password spraying, and attempting to create Active Directory backdoor accounts.

Two caveats are worth stating. The campaign rests on a single vendor report that has not been independently confirmed, and Dream's own figures put the per-attempt success rate near 10 percent even against an appliance whose offsets can be precomputed from firmware. CISA added Fragnesia to KEV on 2026-10-28 with a three-day deadline and a forensic triage requirement. No ransomware use has been reported.

Remediation

1. Install your distribution's fixed kernel and reboot. Upstream, the fix is commit f84eca581739 in stable 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, and 5.15.208.
2. Confirm you are not relying on a Dirty Frag patch. The Dirty Frag kernel patches do not fix Fragnesia and one of them enabled it.
3. If you cannot reboot immediately, unload and blacklist the esp4, esp6, and rxrpc modules via a modprobe.d configuration file. This closes both Dirty Frag and Fragnesia. Sites that applied the Dirty Frag module blacklist are already covered.
4. After patching or blacklisting, drop the page cache with echo 3 > /proc/sys/vm/drop_caches so any modified binary is reloaded from disk.
5. Prioritise multi-tenant surfaces: shared hosting, Kubernetes nodes, CI runners, build farms, and any appliance exposing PHP to the internet. Patch PHP for CVE-2026-109618 and CVE-2026-109619 at the same time, since that pair is what supplies the local foothold.
6. Review logs for unexplained su or sudo successes, for unprivileged processes creating user and network namespaces, for XFRM state changes from non-IPsec workloads, and for reverse SSH tunnels out of management networks. Note that the file change itself leaves nothing on disk, so an on-disk integrity scan will come back clean on a compromised host.
7. Treat any internet-facing appliance that was unpatched during 2026-10-21 to 2026-10-28 as a candidate for compromise assessment, and rotate firewall, LDAP, and domain credentials readable from those systems if anything is found.
8. Federal civilian agencies must remediate by 2026-10-31 under BOD 22-01, and follow CISA's forensic triage requirements before remediating, because a reboot destroys the evidence.