high severityConfidence highHistorical record

Fragnesia (CVE-2026-46300): a Linux kernel bug that rewrites read-only files in memory, used to turn PHP2Shell web shells into root, now on CISA KEV

Direct answer

Fragnesia (CVE-2026-46300): a Linux kernel bug that rewrites read-only files in memory, used to turn PHP2Shell web shells into root, now on CISA KEV, also tracked as Fragnesia / CVE-2026-46300 / Linux kernel Fragnesia is a high-severity threat campaign HOL Guard tracked from May 13, 2026 to Oct 28, 2026, verified against 10 primary sources and last reviewed Oct 28, 2026. Active tracking has ended and the record remains published as a permanent historical research record.

CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation in the XFRM ESP-in-TCP path. skb_try_coalesce() moved page-cache-backed fragments between socket buffers without preserving the SKBFL_SHARED_FRAG marker, so ESP input decrypted them in place and XORed attacker-chosen AES-GCM keystream bytes into the page cache of read-only files. V12 disclosed it on 2026-05-13 with a public exploit that overwrites /usr/bin/su in memory; the fix (commit f84eca581739, 'net: skbuff: preserve shared-frag marker during coalescing') is in stable 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Dream reported on 2026-10-27 that attackers chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, mostly firewall appliances, including systems on a US government-affiliated network, overwriting /etc/pam.d/su with pam_permit.so. CISA added it to KEV on 2026-10-28 with a 2026-10-31 due date and forensic triage required. The change lives in the page cache, not on disk, so a reboot or cache drop removes both the backdoor and the evidence.

Also tracked as Fragnesia · CVE-2026-46300 · Linux kernel Fragnesia · ESP-in-TCP page cache write · Dirty Frag variant · espintcp privilege escalation · PHP2Shell Fragnesia chain

First observed
May 13, 2026
Last observed
Oct 28, 2026
Last reviewed
Oct 28, 2026
Tracking ended
Oct 28, 2026

Record exports

JSON recordArtifact CSVSTIX 2.1 bundle

Uncertainty and limitations

Read the evidence limits before acting on this record.

Dream does not name the firewall vendor or affected firmware versions, and could not determine whether the Active Directory password spray or backdoor account creation succeeded. CISA's KEV entry does not describe the exploitation it observed. Hyunwoo Kim's analysis says exploitation needs user namespace creation unless chained; how that applied on the appliances Dream examined is not public.

  • Ubuntu 20.04 and older on their standard kernels are listed as not affected by Canonical
  • Hosts that block the esp4 and esp6 modules cannot reach the vulnerable path
  • Exploitation is local: an attacker needs code running on the host first
  • Being patched for Dirty Frag (CVE-2026-43284, CVE-2026-43500) does not include the Fragnesia fix

Guard coverage and policy

What Guard's reviewed assertions do and do not claim for this campaign, and the reviewed starting points for defense.

Not covered, or partially covered

  • not covered

    HOL Guard reviews AI coding agent actions on developer machines. It does not patch kernels or inspect servers or appliances for page-cache tampering; the fix is a patched kernel or vendor firmware.

No campaign-specific policy guidance is published.

Safe next step. Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

Open policy controlsCampaign-specific emergency policy starting point

Timeline

Reviewed events, oldest first, each tied to a verified source.

  1. Disclosure

    V12 discloses Fragnesia with a public exploit; reposted to oss-security and assigned CVE-2026-46300 the same day.

    Sources:oss-security: Linux kernel LPE (fragnesia)·oss-security: Hyunwoo Kim analysis and Dirty Frag mitigation

  2. Vendor action

    The standalone fix for CVE-2026-46300 is merged into the netdev tree (commit f84eca581739).

    Sources:oss-security: Dirty Frag variants fix merged into netdev·Linux kernel commit f84eca581739: net: skbuff: preserve shared-frag marker during coalescing

  3. First observed

    Dream publishes artifacts showing a PHP2Shell plus Fragnesia chain rooted 25 servers, including a US government-affiliated network.

    Source:Dream Research: Chained PHP2Shell Exploit Roots 25 Servers

  4. Update

    CISA adds CVE-2026-46300 to KEV (catalog 2026.10.28), due 2026-10-31, forensic triage required.

    Source:CISA KEV catalog entry for CVE-2026-46300

  5. Update

    HOL publishes operator guidance on checking page-cache tampering before reboot and patching.

    Source:HOL: Fragnesia CVE-2026-46300 is on CISA KEV

Publication clock: 4042.0 hours from reviewed disclosure timestamp to HOL publication; 24-hour high target; historical backfill outside target.

Reviewed artifacts

The specific artifacts this record concerns, as reviewed. Names and versions are shown as text; a registry link is not recorded here.

  • Linux kernel@ESP-in-TCP builds before 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208 or distro fixotherpackage

Sources

Every claim on this record is traceable to the sources below.

Related reviewed records

Records this one was reviewed against. Every relationship below is part of a released revision, with the reviewer’s stated reason.

Campaign questions, answered

CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation in the XFRM ESP-in-TCP path. skb_try_coalesce() moved page-cache-backed fragments between socket buffers without preserving the SKBFL_SHARED_FRAG marker, so ESP input decrypted them in place and XORed attacker-chosen AES-GCM keystream bytes into the page cache of read-only files. HOL Guard tracked the campaign from May 13, 2026 to Oct 28, 2026.

No. Active tracking ended Oct 28, 2026; this page remains as a labeled historical research record and does not imply the threat is currently active.

The record cites 10 primary sources, names 1 reviewed artifact, and was last fully reviewed Oct 28, 2026 by HOL Guard Security Publishing. Its uncertainty and limitations are stated on the record itself.

Campaign guidance is defensive context. It does not auto-apply policy or claim universal campaign coverage.

The permalink above is permanent. The full record can be downloaded from this page as JSON, an artifact CSV, and a STIX 2.1 bundle, and corrections can be requested through the published correction path on the record. Dream does not name the firewall vendor or affected firmware versions, and could not determine whether the Active Directory password spray or backdoor account creation succeeded.

Reviewed in full by HOL Guard Security Publishing.

Published
Last full review
Last modified

Report a correction

Record HGTC-2026-A82FB412