Fragnesia CVE-2026-46300: patch the Linux kernel (PHP2Shell)

Fragnesia is the name given to CVE-2026-46300, a Linux kernel flaw disclosed on May 13, 2026 with a public proof of concept. The defect fits in one sentence: the skb_try_coalesce() function loses the marker that flags a shared fragment, so ESP decryption runs in place on page cache pages. An unprivileged process can then modify, in memory, a file that is supposed to be read-only, such as /usr/bin/su, and gain root. The CVSS 3 score is 7.8, and Ubuntu rates the flaw High priority. Fixes have existed since May: AlmaLinux put them into production on May 16, 2026. What changes at the end of October 2026 is the context, because CISA listed the flaw in its catalog of exploited vulnerabilities on October 28, 2026.

A local privilege escalation does not trigger on its own: it first needs an entry point. On an agency server, the entry point is easy to find, a PHP site. PHP2Shell names two flaws in the interpreter, CVE-2026-109618 and CVE-2026-109619, that allow code execution without authentication. The webshell then runs under the site's account, without privileges. Fragnesia is the next step: it turns that account into root. The company Dream reports having observed this combination in a campaign targeting firewalls; this is the account of a single vendor, which CISA does not confirm. On CISA's side, CVE-2026-46300 is in the catalog with a due date of October 31, 2026 and a forensic triage requested from US agencies. Above all, remember this: fixing PHP closes the entry, not the escalation. A server visited before the PHP fix stays dangerous until its kernel is up to date. The PHP2Shell guide linked below this article covers the first part.

This is the trap that turns "everything is up to date" into a server that is still vulnerable. Installing a kernel package drops new files into /boot, but the kernel in memory remains the one from the last boot. Until the machine reboots, apt or dnf can report an up-to-date system while uname -r still answers with the old number. This is common across a fleet for a simple reason: nobody likes rebooting a server that carries client sites, so the reboot waits. Two reference points avoid confusion. On Ubuntu, the number in the table has two parts: 5.15.0-181.191 corresponds to 5.15.0-181-generic in uname -r. On Debian, uname -r shows the kernel ABI, not the package version; uname -v displays the full version, for example "Debian 6.1.190-1".

Rebooting cuts the sites, and the objection is legitimate. The workaround exists for that: it blocks the loading of esp4, esp6 and rxrpc, the three modules the flaw goes through, without a reboot. Its price is precise. ESP is the encryption protocol of IPsec and rxrpc serves AFS; if the server terminates or carries IPsec tunnels (strongSwan, Libreswan) or mounts AFS, the workaround breaks them, and AlmaLinux says so plainly. A simple rule: on a web server without VPN, apply the workaround now, then the kernel at the next slot; on a VPN gateway, fixed kernel on a reboot slot, without the workaround. In both cases, the workaround is only a bridge until the reboot onto the fixed kernel. AlmaLinux also states that the workaround published for Dirty Frag already covers Fragnesia: if it is in place, there is nothing to add.

A server patched since May is not concerned; a server that has never rebooted is, and if it has carried a vulnerable PHP site, it may have been visited. The alteration happens in the page cache: it does not necessarily write to disk, and a reboot or drop_caches erases it. So run your checks first. Three leads. Recent .php files under the web roots: sudo find /var/www /home -name '*.php' -mtime -7 -type f, to adapt to your paths. Unexpected setuid binaries: sudo find / -xdev -perm -4000 -type f -mtime -30. Package integrity: rpm -V util-linux on the RHEL family, sudo debsums -s util-linux on Debian and Ubuntu after apt install debsums; the util-linux package provides /usr/bin/su, the target cited by AlmaLinux. A suspicious result is not cleaned up by hand: isolate the machine and treat it as compromised.

Time is not lost in the command, but in knowing which machine carries which clients, which one is a VPN gateway and when it can reboot. Build a table per server: running kernel, installed kernel, role (web, VPN, database), workaround applied or not. Then sort into three batches: simple web servers, immediate workaround then kernel at the slot; gateways, kernel at the slot without the workaround; machines already up to date, a simple check of the running kernel. Warn clients once, on a common slot, rather than machine by machine. The reboot method for a VPS that carries client sites is detailed in the PwnEscape and Vghost guide linked below this article, no need to repeat it here. This guide is provided as is: administering your servers remains your responsibility, with no support from us.

Ubuntu page for CVE-2026-46300: https://ubuntu.com/security/CVE-2026-46300

Debian security tracker: https://security-tracker.debian.org/tracker/CVE-2026-46300

AlmaLinux notice on Fragnesia: https://almalinux.org/blog/2026-05-13-fragnesia-cve-2026-46300/

CloudLinux article (kernels and KernelCare): https://blog.cloudlinux.com/fragnesia-mitigation-and-kernel-update

CISA alert of October 28, 2026: https://www.cisa.gov/news-events/alerts/2026/10/28/cisa-adds-two-known-exploited-vulnerabilities-catalog

SecurityWeek report on the PHP2Shell chain: https://www.securityweek.com/china-linked-hackers-exploit-php2shell-to-root-firewalls/

Upstream fix in the kernel: https://git.kernel.org/linus/f84eca5817390257cef78013d0112481c503b4a3