[Urgent] Linux Kernel "Fragnesia" CVE-2026-46300: Added to CISA KEV on Oct 28 — Update the Kernel and Reboot (CVSS v3.1 7.8)

The Linux kernel vulnerability "Fragnesia" (CVE-2026-46300, CVSS v3.1 7.8 HIGH) was added to CISA's KEV catalog on October 28, 2026. KEV lists vulnerabilities that have been exploited in the wild. The flaw lets someone who can log in to a machine as an ordinary user (or an attacker who has taken over such an account) gain root privileges. Install your distribution's kernel update and reboot.

This is not a flaw that can be attacked directly over the network. Red Hat rates it "Important" because the attacker needs a local account. But on shared servers, jump hosts, CI runners and container hosts, a pattern of "get in through some other weakness, then become root with this" is realistic. Ubuntu lists the impact as local privilege escalation or container escape. CISA's KEV description also says that, chained with the PHP flaws we covered earlier (CVE-2026-109618 and CVE-2026-109619), this flaw can be used to implant PHP webshells and run commands as root. If you run PHP, update both PHP and the kernel.

Where the score comes from: 7.8 (CVSS v3.1; attack vector local, privileges required low, no user interaction) is the same in NVD, Red Hat and CVE.org (checked through the NVD API). As of October 29 we could not find a v4.0 value. CISA lists the flaw in KEV as a "missing initialization of a variable", while Red Hat classifies it as a write-what-where condition (CWE-123), so the classification name differs by source.

What happens (as publicly documented)

• ▸Where: the kernel's IPsec (ESP-in-TCP) handling. The function `skb_try_coalesce()`, which merges network data, fails to carry over the "this data is shared" marker (SKBFL_SHARED_FRAG). As a result, ESP input processing can decrypt in place over memory that is shared (NVD and Ubuntu descriptions)
• ▸Result: an ordinary user can write arbitrary bytes into the in-memory copy (page cache) of read-only files. Red Hat says this can be used to overwrite privileged programs and become root
• ▸The finder's description: the finder's post (oss-security, May 13) says the write works without a race condition and gives an example that overwrites the first 192 bytes of `/usr/bin/su` in memory to get a root shell. It also says only the in-memory copy changes; the file on disk does not. (Our reading: a file-integrity check alone may not catch it.)
• ▸Related bug: Red Hat's bug tracker describes it as a variant of "Dirty Frag", a 2026 kernel flaw. It is a separate defect with its own CVE number
• ▸Exploit code: the finder has published a proof of concept (oss-security post). CISA does not say how many attacks, when, or by whom. Its KEV description does say the flaw can be chained with the two PHP flaws (CVE-2026-109618 and CVE-2026-109619) to implant PHP webshells and run commands as root, but not that real attacks used that chain. Ransomware use is listed as "Unknown" in KEV

Affected kernels and fixed versions

The reliable way to check is to read your kernel version with `uname -r` and then look at your distribution's advisory. Many distributions backport fixes without changing the version number, so the number alone may not tell you. For reference, here is what is publicly documented.

• ▸Upstream kernel: per the Linux CNA record (on CVE.org), kernels from 3.9 are affected, and the fix is included from 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 onward (7.1 is not affected). NVD's range for the 5.10 line runs "through 5.10.257", so the two records disagree on 5.10.257. If you use that line, check your distribution's advisory (Debian lists 5.10.257-1 for bullseye as fixed). The mainline fix commit is `f84eca58…`
• ▸Ubuntu: fixed in 7.0.0-22.22 (26.04 LTS), 6.17.0-35.35 (25.10), 6.8.0-124.124 (24.04 LTS) and 5.15.0-181.191 (22.04 LTS). for 20.04, the standard `linux` package is listed as not affected, but the HWE kernel (`linux-hwe-5.15`) is affected and fixed in 5.15.0-181.191~20.04.1 (provided through Ubuntu Pro) (Ubuntu page)
• ▸Red Hat: RHEL 8, 9 and 10, plus RHEL CoreOS, OpenShift, OpenStack and Virtualization that use the RHEL kernel. Fixes have been released (Red Hat bulletin)
• ▸Debian: the official tracker shows the status for each release (linked below). We do not copy version numbers here

What to do today

• ✓★Check and update the kernel. Read your current version with `uname -r`, then install the kernel update with `apt`, `dnf` or your package manager. A kernel only takes effect after a reboot (our note; if you use live patching, follow your provider's guidance)
• ✓Run `uname -r` again after the update. If you installed the update but did not reboot, you are still on the old kernel
• ✓On a VPS or cloud service, also check the provider's kernel (image) update status. For services where you cannot update the kernel yourself, wait for the provider's fix
• ✓On shared systems, review the other accounts. Unused accounts, reused passwords and forgotten public keys are the kind of "way in" this class of flaw depends on (our note)
• ✓CISA asks for an initial forensic triage for KEV items under its directive (a requirement for US federal agencies; it does not bind organizations in other countries). On public-facing servers it is safer to also review the period before you updated for suspicious logins or root use

If you cannot update right away (vendor mitigations and side effects)

Red Hat's CVE-2026-46300 page points to its bulletin RHSB-2026-003 for the mitigation procedure. The finder's post also says the mitigation is "the same as for Dirty Frag". There are two options, and both have side effects. Undo them once you have updated.

• ▸Option 1: stop the IPsec modules. Check whether IPsec is in use with `lsmod | grep -E 'esp4|esp6'`. If not, make `esp4` and `esp6` impossible to load and unload them (Red Hat shows writing `install esp4 /bin/false` and `install esp6 /bin/false` into `/etc/modprobe.d/dirtyfrag.conf`). Side effect: IPsec stops working. To undo it, delete that file
• ▸Option 2: disable unprivileged user namespaces. This is the choice if you need to keep IPsec; Red Hat shows setting `user.max_user_namespaces=0`. Side effect: it may affect rootless containers, sandboxed browsers and Flatpak
• ▸Neither replaces the update. Red Hat also notes that other ways to gain local access remain, and recommends hardening such as enforcing SELinux and running workloads as non-root

Before you run any command, read the full vendor bulletin linked above. A mistake in a configuration file can switch off features you need.

What we could not confirm

• ▸How many attacks, when, and by whom. CISA does not say who used it, how many times, or when. It also does not say whether the PHP chain in the KEV description was used in real attacks. This article cannot show whether there has been damage in Japan
• ▸Additional NVD scores for other CVSS versions. As of October 29 we confirmed only the v3.1 score of 7.8
• ▸The latest fixed versions for every distribution. We list Ubuntu and the upstream kernel; for others, check each vendor's advisory

Share these three lines

• ▸The Linux kernel flaw "Fragnesia" (CVE-2026-46300, CVSS v3.1 7.8) was added to CISA's exploited-vulnerability catalog (KEV) on October 28. An ordinary user can gain root
• ▸★Install your distribution's kernel update and reboot. Confirm the new version with `uname -r`. If you cannot update, use the mitigation in Red Hat's bulletin RHSB-2026-003 after reading its side effects
• ▸Shared servers and container hosts come first. Also list accounts that are no longer used

Pages this article is based on