Linux

Linux kernel Fragnesia (CVE-2026-46300): CISA lists it as exploited with a Oct 31 deadline; patch PHP and the kernel, then reboot

CVE-2026-46300, nicknamed Fragnesia, is a flaw in the Linux kernel that lets a low-privileged local user gain root (CVSS v3.1 7.8, local attack vector). When the kernel moves data fragments between network buffers it can lose a marker that says the data is shared with a file in memory, and the IPsec ESP code can then decrypt over the cached copy of a read-only file. The kernel project published the CVE on May 23, 2026, and fixes are in kernel 5.10.257, 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10 and later. On October 28, 2026 (US time) CISA added it to its Known Exploited Vulnerabilities (KEV) catalog on evidence of active exploitation, with a due date of October 31 for US federal agencies. CISA's description says it can be chained with the PHP flaws CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. A security company reported that this chain was used against 25 servers (mostly firewalls), and SecurityWeek repeated the report; this site has not independently verified the numbers. Ubuntu, Red Hat and Debian have shipped fixed kernels, and a kernel update takes effect only after a reboot. This site's conclusion: if you run PHP sites on Linux, update PHP and the kernel, reboot, and check for webshells.