Fragnesia Linux Kernel Flaw CISA KEV Explained: 31 October Deadline, Firewall Chain and What to Patch

fragnesia linux kernel flaw cisa kev explained — server racks in a data centre, the kind of Linux systems Fragnesia affects

Image: Wikimedia Commons (CC0) — server racks at NERSC (illustrative image; Fragnesia is a kernel software flaw, not a piece of hardware).

TL;DR: fragnesia linux kernel flaw cisa kev explained: on 28 October 2026, CISA added Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation flaw, to its Known Exploited Vulnerabilities catalog, with a 31 October deadline for US federal agencies. Attackers have already chained it with the PHP2Shell flaws to turn a web-server foothold into full root access on firewalls — patch the kernel, and reboot, before the deadline.

📌 KEY HIGHLIGHTS

The listing: CISA added CVE-2026-46300 to the KEV catalog on 28 October 2026, with a 31 October 2026 due date and forensic triage required for affected federal systems.
The flaw: a missing-initialization bug (CWE-456, CVSS 7.8) in the kernel's socket-buffer handling that lets a local attacker corrupt the page cache of read-only files — and become root.
The chain: security firm Dream reports attackers chained it with the PHP2Shell flaws to root 25 servers across the US, Japan, Taiwan and South Korea on 23–24 October, reaching a US government-affiliated network.
The fix: patched kernels have existed since May 2026 (5.10.257+, 5.15.208+, 6.1.174+, 6.6.141+, 6.12.91+, 6.18.33+, 7.0.10+, 7.1+) — but a patch only counts once the system has rebooted into it.
The catch: patching PHP alone does not close this hole. Fragnesia lives in the kernel, so firewalls and servers need BOTH updates.

Fragnesia Linux kernel flaw CISA KEV explained: what happened?

On 28 October 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a Linux kernel vulnerability called Fragnesia to its Known Exploited Vulnerabilities (KEV) catalog. The KEV catalog is reserved for flaws with confirmed evidence of exploitation in the wild, so the listing is CISA's way of saying this bug is no longer theoretical. Federal civilian agencies must remediate it by 31 October 2026 under Binding Operational Directive 26-04, and CISA requires forensic triage of affected systems — checking whether they were actually compromised, not just patching and moving on. Ransomware use is listed as unknown.

The listing landed the same week as the first documented real-world use of the flaw. Cybersecurity firm Dream reported that a suspected China-linked attacker chained Fragnesia with PHP2Shell — the pair of critical PHP flaws (CVE-2026-109618 and CVE-2026-109619, both CVSS 9.2) that CISA added to KEV on 26 October — to break into internet-facing firewalls. The attackers scanned roughly 19,000 exposed firewall management interfaces using the FOFA search engine, narrowed about 5,000 responding devices down to 240 running PHP 8.0.30, and ran an automated exploit against them on 23–24 October. The result, according to Dream via The Hacker News: 25 servers rooted across the US, Japan, Taiwan and South Korea, with PHP root webshells planted on 24 of them (one firewall crashed shortly after exploitation).

How Fragnesia turns a foothold into root

Fragnesia is a local privilege-escalation flaw, which matters for understanding why it is dangerous only in combination — and why that combination is so effective. On its own, it needs local access to a machine, which is why Red Hat rates it Important rather than Critical. PHP2Shell supplies exactly that access: it gives an unauthenticated attacker the ability to run commands as the web-server user. Fragnesia then turns that limited user into root.

The bug sits in the kernel's IPsec ESP-in-TCP path. When the kernel merges socket buffers, a function called skb_try_coalesce() fails to carry over a flag (SKBFL_SHARED_FRAG) that marks fragments shared with the page cache — the kernel's in-memory copy of file contents. Later, when ESP input decrypts data in place, it writes directly into those shared, supposedly read-only pages instead of copying them first. An attacker who can feed file contents into a socket and then enable ESP-in-TCP encryption on it can therefore rewrite the cached copy of a privileged binary such as /usr/bin/su, without touching the file on disk. The public proof-of-concept, published alongside the disclosure on 13 May 2026 by researcher William Bowling and the V12 team, does exactly this — deterministically, with no race condition to win. Because only the in-memory copy changes, standard disk forensics may find nothing wrong.

Inside the US government-affiliated environment, Dream reports, the attackers went further after rooting a second firewall on 24 October: they built a reverse SSH tunnel for persistence, reached an internal firewall management server holding the configurations and credentials for every firewall that organisation managed, decrypted an LDAP service-account password, enumerated domain users and groups, sprayed passwords, and attempted to create Active Directory backdoor accounts. Two honesty notes: Dream did not name the firewall vendor or a specific attacker group — the China link rests on clues such as Chinese-language prompts, China time-zone settings and AI tooling found in the attack infrastructure (Claude Code, FOFA API keys, and an offensive platform configured with DeepSeek and Kimi models) — and whether the credential extraction or backdoor-account attempts actually succeeded remains unconfirmed.

fragnesia linux kernel flaw cisa kev explained — server racks in a computer server room

Image: Wikimedia Commons / NOIRLab/NSF/AURA/T. Slovinský, CC BY 4.0 — server racks at the NOIRLab Headquarters computer server room (illustrative image).

Fixed kernels: what to patch, and the reboot rule

Kernel series	First fixed release	What to do
5.10	5.10.257 and later	Update via your distribution, then reboot
5.15	5.15.208 and later	Update via your distribution, then reboot
6.1 (long-term)	6.1.174 and later	Update via your distribution, then reboot
6.6 (long-term)	6.6.141 and later	Update via your distribution, then reboot
6.12 (long-term)	6.12.91 and later	Update via your distribution, then reboot
6.18 / 7.0 / 7.1	6.18.33+, 7.0.10+, 7.1+	Update via your distribution, then reboot
PHP on the same box	8.2.35, 8.3.36, 8.4.27, 8.5.12	Patch PHP too — the chain needs both halves closed

Two practical points. First, distributions backport fixes, so your distribution's own security tracker is authoritative for your exact system — a kernel version number alone can mislead if your distro backported the fix to an older number. Second, a kernel patch does nothing until the machine reboots into it; an un-rebooted server is still running the vulnerable kernel, which is why CISA's guidance stresses verifying the running kernel, not just the installed packages. As a partial mitigation where patching must wait, Ubuntu's default AppArmor restrictions on unprivileged user namespaces can complicate the exploit path, but that is a speed bump, not a fix. CISA also added a second flaw the same day — a low-severity VMware ESX logging bug (CVE-2026-41709, due 11 November) — worth checking if you run ESX, but it is a separate issue from Fragnesia.

Why it matters for World Tech readers — and what it means for India

Linux runs the internet's plumbing: web servers, firewalls, cloud hosts and containers all sit on it, so a kernel privilege-escalation flaw with a working exploit is a systemic risk, not a desktop curiosity. The Dream campaign shows why: the targets were not random servers but firewall appliances — the very boxes meant to keep attackers out — running an identical PHP 8.0.30 build across thousands of internet-facing devices, which let the attackers pre-compute the exploit for one build and automate it at scale. Dream's researchers note that even on that fixed target, only about 1 in 10 exploit attempts succeeded — but with 240 targets and automation, that was more than enough.

For India, no Indian victim is named in this campaign, and this post claims none. The relevance is direct all the same: Indian organisations run the same Linux-and-PHP estate — web servers, hosting panels, firewalls and cloud instances — and CERT-In has already warned Indian administrators about the PHP2Shell half of this chain, including hundreds of government websites found running vulnerable PHP. Any Indian team that patched PHP last week but has not yet updated and rebooted its kernels still has the second half of the attack chain open. Check both halves, prioritise internet-facing systems, and treat any internet-facing box that ran a vulnerable kernel while exposed as a candidate for forensic triage, not just a patch job. Read it alongside our PHP2Shell CISA KEV explainer for the first half of the chain, our PHP session upload progress flaw explainer for the follow-up PHP bug, and our Magento PolyShell CISA KEV explainer for the week's other exploited-web-platform story.

Should you care?

✅ Act now if you run Linux servers, firewalls or containers — especially internet-facing ones, and doubly so if they also run PHP: update the kernel, update PHP, reboot, and verify the running kernel version. ⏳ Wait if you are a home desktop user on a fully updated distribution — your distro likely shipped this fix months ago — but still confirm you have rebooted since the update.

FAQs

What is Fragnesia? Fragnesia is a Linux kernel local privilege-escalation vulnerability, tracked as CVE-2026-46300, nicknamed for its place in the Dirty Frag family of flaws. A missing-initialization bug lets an attacker corrupt the kernel's page cache of read-only files and gain root access.

Is Fragnesia being actively exploited? Yes. CISA added it to the Known Exploited Vulnerabilities catalog on 28 October 2026, which requires confirmed exploitation evidence, and security firm Dream documented its use in a firewall attack campaign on 23–24 October 2026.

Which Linux kernel versions fix Fragnesia? Fixed releases include 5.10.257+, 5.15.208+, 6.1.174+, 6.6.141+, 6.12.91+, 6.18.33+, 7.0.10+ and 7.1+. Distributions backport fixes, so check your distribution's security tracker, and reboot after updating so the fixed kernel is actually running.

Do I still need to patch Fragnesia if I already patched PHP2Shell? Yes. The two flaws live in different layers: PHP2Shell is the foothold, Fragnesia is the privilege escalation. Patching PHP removes the known entry point, but an unpatched kernel leaves the root step open to any other foothold.

What is the CISA deadline for Fragnesia? US federal civilian agencies must remediate CVE-2026-46300 by 31 October 2026, with forensic triage required. The deadline does not legally bind private or Indian systems, but it marks the date by which CISA expects a confirmed-exploited flaw to be closed.

Takeaway: PHP2Shell opened the door; Fragnesia handed over the keys to the building. Both halves of that chain now have fixes — the only systems still at risk are the ones that have not installed them, or have not rebooted yet.

Follow World Tech on TechByCountry for tomorrow's update.

📸 Get tech in the last 24 hours on Instagram — follow @_techinlast24hrs for daily posts (9 AM–9 PM) and reels at 12:30 PM & 8:30 PM.

TechByCountry — Daily Tech News, Country by Country

Search This Blog