What happened

Fragnesia is a flaw in the Linux kernel's XFRM ESP-in-TCP code, the part that carries IPsec traffic over TCP. According to Red Hat, "unsafe in-place cryptographic processing allows a low-privileged local attacker to write arbitrary bytes into the page cache of read-only files." The page cache is the kernel's in-memory copy of files, so an attacker can change what a protected file says without touching the disk, for example rewriting a setuid binary or an authentication rule. It is scored CVSS 3.1 7.8: local access needed, low privileges, no user interaction. Red Hat tracks it as a variant of the "Dirty Frag" bugs (CVE-2026-43284 and CVE-2026-43500), but the Dirty Frag patches do not include the Fragnesia fix. The fix is commit f84eca581739, "net: skbuff: preserve shared-frag marker during coalescing," shipped in stable kernels 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208. A public exploit that overwrites /usr/bin/su in memory has been available since the May disclosure.

On October 26, the security firm Dream published what it found after investigating one campaign. The attacker had built a custom exploit for PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which ran code as the web server's unprivileged user. SELinux stopped that user from changing system files, so the attacker used Fragnesia to overwrite /etc/pam.d/su in memory with a rule that accepts any password. After that, su root worked with no password. Dream says the chain took under 15 minutes per host and rooted 25 servers across the United States, Japan, Taiwan and South Korea. Most were firewalls running "specific versions of a large vendor's firewall software," which Dream did not name. Two belonged to a US government-affiliated organization. From one, the attacker tunneled to an internal management server and enumerated Active Directory. Dream does not attribute the activity to a named group but says "multiple indicators point to a Chinese-nexus operation."

CISA added CVE-2026-46300 to the KEV catalog on October 28, alongside a VMware ESX logging flaw, with a remediation deadline of October 31. CISA's catalog lists it as "Linux Kernel Missing Initialization of a Variable Vulnerability."

Why it matters if you run public infrastructure

A local privilege escalation is often filed as lower priority because the attacker needs to be on the box already. This campaign shows how little that means once a remote bug supplies the first step. PHP2Shell gave code execution as a web user, and Fragnesia turned it into root, defeating SELinux. Appliances are the hard case. Firewalls and VPN gateways run their own Linux builds that you cannot patch yourself, so you depend on the vendor shipping both the PHP fix and the kernel fix. And a host compromised before you patched PHP may already have a root web shell that a PHP update does not remove.

What to check this week

  1. Patch the kernel and reboot. Install your distribution's fixed kernel (Ubuntu 24.04: 6.8.0-124.124 or later; 22.04: 5.15.0-181.191 or later; RHEL 8, 9 and 10: the fixes in RHSB-2026-003) and reboot into it. A kernel package that is installed but not running does not help.
  2. If you cannot reboot yet, block the vulnerable path. On hosts that do not use IPsec, Red Hat's bulletin blocks the ESP modules: printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf then rmmod esp4 esp6. This breaks IPsec. Where IPsec is needed, Red Hat's alternative is disabling unprivileged user namespaces (user.max_user_namespaces=0), which can affect rootless containers and sandboxed browsers.
  3. Ask your firewall and VPN vendors whether their firmware includes both the PHP2Shell fix and a kernel with the Fragnesia fix, and apply their updates. Dream did not name the vendor involved, and says the vendor has been notified.
  4. Look for the persistence Dream describes. Check that /etc/pam.d/su matches your distribution's original, and look for small unfamiliar PHP files in web roots, new systemd units or rc.local entries, and outbound SSH tunnels. On any host that ran a vulnerable PHP before you patched, also follow the checks in our PHP2Shell post.

How Attack Surface Scan covers this

A kernel version is not visible from the internet, so Attack Surface Scan does not raise a finding for CVE-2026-46300. What it does flag is the first step of this chain: hosts under your verified domains that announce a PHP version vulnerable to PHP2Shell, ranked first because both CVEs are on KEV, plus potential matches on PAN-OS GlobalProtect portals. Any host with a PHP2Shell finding should get the kernel fix too. The inventory also lists the firewall and VPN sign-in pages under your domains, so you know which appliances to raise with vendors. We do not send exploit traffic. See Vulnerability matching for how matching works.

Frequently asked questions

Is Fragnesia exploitable over the network?

Not by itself. It needs code already running on the host as some user. The danger is pairing it with a remote bug such as PHP2Shell, which supplies that first step from the internet.

I already patched for Dirty Frag. Am I covered?

Not necessarily. Fragnesia is a separate variant, and the Dirty Frag fixes do not include it. Check that your running kernel is at or above the fixed version for your branch or distribution.

Sources