Who this is for: people who run Linux servers, especially web servers with PHP, WordPress or Laravel, and teams that run containers. This article is based on the CISA alert and catalog, the kernel project's CVE record, Ubuntu, Red Hat and Debian pages, and a security company's report. It does not cover attack steps or exploit code.
Developing: this page will be updated as more is published
As of 00:00 UTC, October 29, 2026Not yet known
- Who is being attacked and how widely (CISA gave no details)
- The vendor and versions of the firewalls in the security company's report
- NVD's own assessment
- Whether other distributions and appliance makers have shipped fixed kernels
The kernel project published the CVE on May 23, 2026. CISA added it to its KEV catalog on October 28 (US time) with a due date of October 31. Distribution kernels are already available for Ubuntu, Red Hat and Debian.
1. PHP flaw (CVE-2026-109618 / 109619)
Code runs as the web server account. Fix: update PHP
Webshell left in the web directory
Look for PHP files you did not add
2. Kernel flaw (CVE-2026-46300)
Web account becomes root. Fix: kernel update and reboot
What to do today
Find out whether the server runs PHP or lets anyone run code locally
Web servers running PHP are the first priority because CISA describes the PHP chain. Shared servers, CI runners, container hosts and any machine where untrusted users or code can run also matter, since the flaw needs only a local low-privileged account (this site's view).
Update PHP
Move to PHP 8.5.12, 8.4.27, 8.3.36 or 8.2.35 or later. The details are in our PHP article. A kernel update does not fix the PHP flaws.
Install the fixed kernel
Use your distribution's update tool and compare the result with the tables below. Ubuntu, Red Hat and Debian have published fixed kernels.
Reboot, then confirm the running kernel
Run uname -r after the reboot. A package that is installed but not running does not protect you. Plan the reboot for today rather than the next maintenance window, because CISA's due date is October 31.
Check for webshells and signs of root access
CISA marks this entry as requiring forensic triage. Look for PHP files you did not add, recently changed files in web directories, new user accounts, new scheduled jobs, new SSH keys, and unfamiliar outbound connections. If you find any, treat the server as compromised and see How to check whether your website or server was compromised.
Fixed versions
| Kernel line | Fixed in | Source |
|---|---|---|
| 5.10 | 5.10.257 | Linux kernel CVE record |
| 5.15 | 5.15.208 | Linux kernel CVE record |
| 6.1 | 6.1.174 | Linux kernel CVE record |
| 6.6 | 6.6.141 | Linux kernel CVE record |
| 6.12 | 6.12.91 | Linux kernel CVE record |
| 6.18 | 6.18.33 | Linux kernel CVE record |
| 7.0 | 7.0.10 | Linux kernel CVE record |
| 7.1 and later | Not affected | Linux kernel CVE record |
Distributions backport fixes without changing the upstream version number, so for packaged kernels go by the distribution's package version, not the upstream number alone.
| Distribution | Fixed kernel package |
|---|---|
| Ubuntu 26.04 LTS | 7.0.0-22.22 |
| Ubuntu 25.10 | 6.17.0-35.35 |
| Ubuntu 24.04 LTS | 6.8.0-124.124 |
| Ubuntu 22.04 LTS | 5.15.0-181.191 |
| Ubuntu 26.10 and 20.04 and older | Listed as not affected (Ubuntu) |
| RHEL 8 | 4.18.0-553.125.1.el8_10 |
| RHEL 9 | 5.14.0-687.10.1.el9_8 |
| RHEL 10.2 | 6.12.0-211.16.1.el10_2 |
| Debian 12 (bookworm) | 6.1.190-1 (security) |
| Debian 13 (trixie) | 6.12.113-1 (security) |
Ubuntu also lists fixed cloud and specialty kernels (AWS, Azure, GCP, Oracle, IBM, Raspberry Pi, real-time and FIPS flavors), so check the flavor you actually run on Ubuntu's page. Red Hat lists fixes for older extended-support streams, and the flaw also affects products built on the RHEL kernel, such as OpenShift. Hosts that use a vendor kernel, such as network appliances, need the appliance maker's update.
What was disclosed
- CVE
- CVE-2026-46300, nicknamed Fragnesia by Ubuntu and Red Hat
- Type
- Missing initialization of a variable (CWE-456 in CISA's catalog). Red Hat classes it as a write-what-where condition (CWE-123)
- Severity
- CVSS v3.1 7.8 (AV:L/AC:L/PR:L/UI:N). Red Hat rates it Important and Ubuntu rates it High
- Where
- Kernel networking code (
skb_try_coalesce()in net/core/skbuff.c) and the IPsec ESP-in-TCP receive path - Impact
- A low-privileged local user can write data into the in-memory cached copy of read-only files, which can lead to root. Ubuntu also says it could allow escaping a container
- Fixed
- See the tables above. The CVE record dates from May 23, 2026
- Known exploited
- Added to CISA's KEV catalog on October 28, 2026 (US time) as "Linux Kernel Missing Initialization of a Variable Vulnerability". Due date October 31. Forensic triage required. Ransomware use: unknown
According to the kernel project's description, the function that moves paged data between two network buffers dropped a marker saying the data is shared with something outside the buffer, such as the cached copy of a file. The IPsec ESP code checks that marker to decide whether it can decrypt in place. With the marker lost, it decrypted over the cached file data. The fix passes the marker along.
Think of local privilege escalation this way: it does not get an attacker onto your server, it turns a small foothold into total control. Combined with a flaw that gives a foothold, such as the PHP ones, it completes the break-in.
This is the same family as the Dirty Frag flaws that Red Hat covered in its bulletin RHSB-2026-003, which lists CVE-2026-43284 (IPsec ESP) and CVE-2026-46300 as the ones that affect Red Hat products. Hosts patched for Dirty Frag earlier still need this fix (this site's view).
Exploitation and the PHP chain
CISA's catalog entry says the flaw "can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root." Those two PHP flaws were added to the KEV catalog on October 26 with a due date of October 29. CISA did not publish who was targeted or how.
A security company reported on October 26 that attackers rooted 25 servers, mostly internet-facing firewall appliances from one unnamed vendor, by combining the two PHP flaws with this kernel flaw. SecurityWeek repeated the report on October 28. The report says the PHP flaws gave code execution as a restricted web server account, and the kernel flaw was used to get root. The report says the affected devices span the US, Japan, Taiwan and South Korea. The company says it informed the vendor and did not name the vendor or the versions. Wording differs between accounts (24 firewalls plus one management server, or 25 in all), and this site could not check the underlying data. Treat the figures as one company's report, not as established fact.
If you run an appliance with a web management interface, ask the maker whether its firmware is affected, and do not leave management interfaces open to the internet (this site's view).
Stop-gaps if you cannot update yet
Red Hat's bulletin says to check whether the esp4 and esp6 modules are in use (lsmod | grep -E 'esp4|esp6') and, if IPsec is not needed, block them. This breaks IPsec, including many VPN setups, so confirm first. Red Hat also describes a narrower option that restricts unprivileged user namespaces, which can affect rootless containers and sandboxed browsers. Ubuntu points to the same procedure it published for Dirty Frag. Neither vendor presents this as a replacement for the fixed kernel. Follow the vendor pages for the exact steps, and remove the block after you boot the fixed kernel.
What is not yet known
| Item | Status |
|---|---|
| Who is exploiting it | CISA says active exploitation but gave no details. The security company's account is unverified |
| The firewall vendor in the report | Not named by the company |
| Public exploit code | Reported by others; this site did not verify it and does not link to it |
| NVD assessment | Not confirmed by this site at the time of writing |
| Other kernels | Appliance makers and cloud images may ship fixes later than the distributions |
Sources
Checked on October 29, 2026 (CISA catalog data and alert, the CVE record, Ubuntu, Red Hat, Debian).
- CISA, "CISA Adds Two Known Exploited Vulnerabilities to Catalog" (October 28, 2026) — cisa.gov / Known Exploited Vulnerabilities Catalog — cisa.gov
- CVE Program record CVE-2026-46300 (Linux kernel CNA, with Red Hat fixed versions) — cve.org
- NVD, "CVE-2026-46300" — nvd.nist.gov
- Ubuntu, "CVE-2026-46300" — ubuntu.com / "Dirty Frag Linux vulnerability fixes available" — ubuntu.com
- Red Hat, "CVE-2026-46300" — access.redhat.com / "Dirty Frag (RHSB-2026-003)" — access.redhat.com
- Debian security tracker, "CVE-2026-46300" — security-tracker.debian.org
- A security company's report on the PHP2Shell chain against firewalls (October 26, 2026) — the report (English)
- SecurityWeek, "China-Linked Hackers Exploit PHP2Shell to Root Firewalls" (October 28, 2026) — securityweek.com
Update history
2026-10-29: First version, based on CISA's October 28 KEV listing, the CVE record, and Ubuntu, Red Hat and Debian information.
Read next
- The PHP half of the chain: PHP flaws CVE-2026-109618 and CVE-2026-109619
- Checking a server: How to check whether your website or server was compromised
- Deciding priority: Deciding what to patch first: CVSS, EPSS and KEV
- When a vulnerability is announced: CVE remediation playbook
- Terms: What is RCE (remote code execution) / What is CVSS