Exploited in the wildHIGHCISA KEV

Linux kernel "Fragnesia" lets a local user reach root; chained in firewall attacks

A logic flaw in the Linux kernel's ESP-in-TCP path lets a low-privileged local user corrupt the page cache of read-only files and escalate to root. CISA added it to KEV on 2026-10-28; researchers report it was chained with PHP2Shell to root firewalls.

Linux (kernel.org) Linux kernel (XFRM ESP-in-TCP / skbuff coalescing)CVE-2026-46300CVSS7.8CWE-456Endpoint & OS
Published Oct 29, 2026

CISA added CVE-2026-46300 to KEV on 2026-10-28 based on evidence of active exploitation. It notes the flaw can be chained with PHP2Shell to implant webshells and run commands as root 1. Dream reports the chain was used against firewalls starting 2026-10-23 8.

May 7, 2026174 daysOct 28, 2026

What you need to know

  • Affects Linux kernels without the 2026-05-13 fix that ship the espintcp module; shared-kernel hosts, container clusters, CI runners and multi-tenant systems carry the most risk.
  • A local unprivileged user can modify the page-cache copy of read-only files (such as /usr/bin/su or /etc/passwd) and escalate to root.
  • CISA added it to KEV on 2026-10-28. Per Dream, it was used as a second stage after PHP2Shell RCE, and the chain rooted 25 servers, mostly firewalls.
  • Apply the vendor kernel update that carries the skb_try_coalesce() fix; Dirty Frag-only patches are not sufficient.
  • Changes exist only in memory, so on-disk hash checks miss tampering; reboot or flush the page cache to clear modified copies if exploitation is suspected.

What's happening

Fragnesia (CVE-2026-46300) is a local privilege escalation in the Linux kernel's XFRM ESP-in-TCP (espintcp) subsystem 7. A low-privileged local user can corrupt the in-memory page-cache contents of read-only files and escalate to root, with no user interaction needed 3. Red Hat rates it Important rather than Critical because local access is required 3. Microsoft's threat intelligence team says exploitation is not limited to /usr/bin/su; any file readable by the user, including /etc/passwd, can be altered in the page cache 12.

The flaw was publicly disclosed on 2026-05-13 with a working proof of concept. At the time, Tenable, Help Net Security and Microsoft all reported no in-the-wild exploitation 7,11,12. That changed in October. CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on 2026-10-28 based on evidence of active exploitation, with a federal due date of 2026-10-31 1,2.

The observed campaign used Fragnesia as the second stage after remote code execution through the PHP2Shell flaws (CVE-2026-109618 and CVE-2026-109619) on firewall management web servers. Fragnesia is a local escalation, not a remote bug by itself 8. Dream reports the chain rooted 25 servers in the US, Japan, Taiwan and South Korea, three of them in a US government-affiliated environment. The attackers planted PHP webshells and set up a reverse SSH tunnel that was used to attack Active Directory 8,9. Dream attributes the activity to a suspected China-nexus actor based on the target set; no government has attributed it 8.

How it works

The root cause is a flag dropped during socket-buffer coalescing. When skb_try_coalesce() merges paged fragments from one socket buffer into another, a source buffer marked SKBFL_SHARED_FRAG hands over fragments that are still backed by the page cache or owned externally. The receiving buffer does not inherit that marker 5. The fix makes skb_try_coalesce() carry the marker over whenever it moves paged fragments 5.

On receive, ESP checks skb_has_shared_frag() to decide whether it can skip copying an uncloned, nonlinear buffer with skb_cow_data(). Because the marker was dropped during TCP receive coalescing, ESP decrypts in place over page-cache-backed fragments and overwrites the cached copy of read-only files 5. Tenable and Wiz describe it as a logic flaw in the same 'Dirty Frag' page-cache-write family. The existing Dirty Frag patches do not fix it, and a separate patch is required 7. CISA classifies it as CWE-456 (missing initialization of a variable). The kernel fix and research descriptions instead point to a shared-frag marker that is not carried across coalescing 1,5.

Preconditions are modest. The public exploit uses unprivileged user and network namespaces, which most distributions enable by default, to gain CAP_NET_ADMIN inside the namespace. No race condition is involved, so exploitation is described as deterministic 6. The kernel must ship the espintcp module; Amazon Linux is reported not affected because it does not include it 7. Changes exist only in memory: on-disk binaries are not altered, and a reboot or page-cache flush restores normal behavior 7.

What to do

In order of priority
  1. 1

    Apply the vendor kernel update that includes the skb_try_coalesce() fix; Dirty Frag-only patches are not sufficient 7.

  2. 2

    Red Hat gives two interim options. Block and unload the esp4/esp6 modules, which breaks IPsec. Where IPsec must keep running, disable unprivileged user namespaces instead, which may affect rootless containers, sandboxed browsers and Flatpak 4.

  3. 3

    Wiz and Tenable give the same module-denylist mitigation for esp4, esp6 and rxrpc. Hosts that applied only the Dirty Frag kernel patches without the denylist remain exposed 7.

  4. 4

    Restrict or disable unprivileged user namespaces where feasible. Apply general hardening that limits local access, such as SELinux enforcing, non-root workloads and restricting oc debug 4,6.

  5. 5

    By 2026-10-31, CISA requires agencies to apply vendor mitigations per BOD 26-04 and complete forensic triage, or stop using the product if mitigations are unavailable 1.

  6. 6

    Tampering can predate mitigation and lives only in memory. Treat suspected hosts as potentially compromised, and reboot or flush the page cache after patching 6,11.

Detection

  • Monitor Linux hosts for suspicious user and network namespace creation, XFRM manipulation and abnormal use of AF_ALG 6.
  • On-disk hash checks will not detect this because the tampering is only in the page cache. If exploitation is suspected, reboot or drop the page cache to clear modified in-memory copies 6.
  • Applying the module mitigation is not enough on hosts that may have been attacked before it was applied, because binaries may already be modified in the page cache 11.
  • In the observed campaign, post-compromise artifacts were PHP webshells in publicly accessible directories on firewall appliances and a reverse SSH tunnel to operator infrastructure. Dream also saw LDAP credential decryption, domain enumeration and password spraying against AD 8,9.
  • CISA's KEV entry requires forensic triage under BOD 26-04 for this CVE 1.

Timeline

  1. Red Hat publishes Dirty Frag bulletin RHSB-2026-003, later updated to cover CVE-2026-46300. 4

  2. Public disclosure of Fragnesia with a proof of concept and kernel patch; CVE-2026-46300 assigned. 7

  3. Help Net Security, Tenable and Microsoft report no in-the-wild exploitation. 11

  4. Earliest dated exploitation in the Dream report: first US-government-affiliated firewall rooted at 18:14 UTC via PHP2Shell + Fragnesia. 8

  5. Second government-affiliated firewall rooted; a reverse SSH tunnel is set up and an internal firewall-management server is rooted. 8

  6. Dream publishes its report; CISA adds the PHP2Shell CVEs to KEV. 10

  7. CISA adds CVE-2026-46300 to KEV with a due date of 2026-10-31. 2

Sources

  1. 1
    CISA KEV catalog entry for CVE-2026-46300
    CISA · Government · Oct 28, 2026
  2. 2
    CISA Adds Two Known Exploited Vulnerabilities to Catalog
    CISA · Government · Oct 28, 2026
  3. 3
    CVE-2026-46300 - Red Hat Customer Portal
    Red Hat · Vendor
  4. 4
    RHSB-2026-003 Networking subsystem Privilege Escalation - Linux Kernel - Dirty Frag
    Red Hat · Vendor · Jul 3, 2026
  5. 5
    CVE-2026-46300 Detail - NVD
    NIST NVD · Database
  6. 6
    Fragnesia: Linux Kernel Local Privilege Escalation via ESP-in-TCP
    Wiz · Research · May 13, 2026
  7. 7
    Fragnesia (CVE-2026-46300): FAQ
    Tenable · Research · May 14, 2026
  8. 8
    PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network
    The Hacker News · News · Oct 28, 2026
  9. 9
    China-Linked Hackers Exploit PHP2Shell to Root Firewalls
    SecurityWeek · News
  10. 10
    CISA warns of Fragnesia Linux flaw chained in PHP2Shell attacks
    BleepingComputer · News
  11. 11
    Fragnesia: New Linux kernel LPE bug was spawned by Dirty Frag patch
    Help Net Security · News · May 14, 2026
  12. 12
    New Linux Kernel Vulnerability Fragnesia Allows Root Privilege Escalation
    SecurityWeek · News

Corroborated by independent sources. Researched and drafted by the VulnDigest briefs agent from 12 sources, then checked against them by a separate review step on Oct 29, 2026.

Exploitation evidence comes from CISA's KEV listing and Dream's research as reported by The Hacker News and SecurityWeek. Kernel maintainers and Red Hat have not commented on exploitation.

The China-nexus attribution is Dream's 'suspected' assessment, based on the countries targeted. No government has attributed the activity, and the targeted firewall vendor has not been disclosed.

Upstream per-branch fixed kernel versions are not listed; check your distribution's advisory. AlmaLinux versions come from Tenable, not AlmaLinux's own advisory.

CISA labels this CWE-456 (missing initialization). Technical descriptions point to a dropped shared-frag flag, which is a logic error.

Some third-party feeds suggest exploitation earlier than 2026-10-23; this could not be confirmed.

No indicators of compromise have been published in the sources reviewed.

Spotted an error? Open an issue on sochub.io.