{
  "schemaVersion": "guard-threat-campaign/v1",
  "id": "HGTC-2026-A82FB412",
  "slug": "cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root",
  "title": "Fragnesia (CVE-2026-46300): a Linux kernel bug that rewrites read-only files in memory, used to turn PHP2Shell web shells into root, now on CISA KEV",
  "aliases": [
    "Fragnesia",
    "CVE-2026-46300",
    "Linux kernel Fragnesia",
    "ESP-in-TCP page cache write",
    "Dirty Frag variant",
    "espintcp privilege escalation",
    "PHP2Shell Fragnesia chain"
  ],
  "summary": "CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation in the XFRM ESP-in-TCP path. skb_try_coalesce() moved page-cache-backed fragments between socket buffers without preserving the SKBFL_SHARED_FRAG marker, so ESP input decrypted them in place and XORed attacker-chosen AES-GCM keystream bytes into the page cache of read-only files. V12 disclosed it on 2026-05-13 with a public exploit that overwrites /usr/bin/su in memory; the fix (commit f84eca581739, 'net: skbuff: preserve shared-frag marker during coalescing') is in stable 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Dream reported on 2026-10-27 that attackers chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, mostly firewall appliances, including systems on a US government-affiliated network, overwriting /etc/pam.d/su with pam_permit.so. CISA added it to KEV on 2026-10-28 with a 2026-10-31 due date and forensic triage required. The change lives in the page cache, not on disk, so a reboot or cache drop removes both the backdoor and the evidence.",
  "status": "published",
  "severity": "high",
  "confidence": "high",
  "uncertainty": "Dream does not name the firewall vendor or affected firmware versions, and could not determine whether the Active Directory password spray or backdoor account creation succeeded. CISA's KEV entry does not describe the exploitation it observed. Hyunwoo Kim's analysis says exploitation needs user namespace creation unless chained; how that applied on the appliances Dream examined is not public.",
  "firstObservedAt": "2026-05-13T09:59:37Z",
  "lastObservedAt": "2026-10-28T19:50:05Z",
  "publishedAt": "2026-10-28T19:58:31.620Z",
  "reviewedAt": "2026-10-28T19:58:25.051Z",
  "expiresAt": "2026-10-28T19:50:05Z",
  "reviewer": "HOL Guard Security Publishing",
  "sources": [
    {
      "id": "cisa-kev",
      "label": "CISA KEV catalog entry for CVE-2026-46300",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300",
      "sourceType": "government",
      "observedAt": "2026-10-28T19:00:04Z"
    },
    {
      "id": "nvd",
      "label": "NVD CVE-2026-46300",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-46300",
      "sourceType": "vulnerability_database",
      "observedAt": "2026-05-23T12:17:02Z"
    },
    {
      "id": "oss-disclosure",
      "label": "oss-security: Linux kernel LPE (fragnesia)",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/13/3",
      "sourceType": "research",
      "observedAt": "2026-05-13T10:59:37Z"
    },
    {
      "id": "oss-kim",
      "label": "oss-security: Hyunwoo Kim analysis and Dirty Frag mitigation",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/13/6",
      "sourceType": "research",
      "observedAt": "2026-05-13T17:35:10Z"
    },
    {
      "id": "oss-merged",
      "label": "oss-security: Dirty Frag variants fix merged into netdev",
      "url": "https://www.openwall.com/lists/oss-security/2026/05/21/11",
      "sourceType": "research",
      "observedAt": "2026-05-21T17:19:42Z"
    },
    {
      "id": "kernel-fix",
      "label": "Linux kernel commit f84eca581739: net: skbuff: preserve shared-frag marker during coalescing",
      "url": "https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3",
      "sourceType": "other_primary",
      "observedAt": "2026-05-21T00:00:00Z"
    },
    {
      "id": "dream",
      "label": "Dream Research: Chained PHP2Shell Exploit Roots 25 Servers",
      "url": "https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers",
      "sourceType": "research",
      "observedAt": "2026-10-27T00:00:00Z"
    },
    {
      "id": "ubuntu",
      "label": "Ubuntu CVE-2026-46300",
      "url": "https://ubuntu.com/security/CVE-2026-46300",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-05-13T00:00:00Z"
    },
    {
      "id": "debian",
      "label": "Debian security tracker CVE-2026-46300",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-46300",
      "sourceType": "vendor_advisory",
      "observedAt": "2026-05-13T00:00:00Z"
    },
    {
      "id": "hol-blog",
      "label": "HOL: Fragnesia CVE-2026-46300 is on CISA KEV",
      "url": "https://hol.org/blog/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root",
      "sourceType": "other_primary",
      "observedAt": "2026-10-28T19:50:05Z"
    }
  ],
  "artifacts": [
    {
      "id": "linux-kernel",
      "artifactClass": "package",
      "ecosystem": "other",
      "name": "Linux kernel",
      "version": "ESP-in-TCP builds before 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174, 5.15.208 or distro fix",
      "defanged": false
    }
  ],
  "indicators": [],
  "timeline": [
    {
      "id": "v12-disclosure",
      "occurredAt": "2026-05-13T09:59:37Z",
      "eventType": "disclosure",
      "summary": "V12 discloses Fragnesia with a public exploit; reposted to oss-security and assigned CVE-2026-46300 the same day.",
      "sourceIds": [
        "oss-disclosure",
        "oss-kim"
      ]
    },
    {
      "id": "netdev-fix-merged",
      "occurredAt": "2026-05-21T17:19:42Z",
      "eventType": "vendor_action",
      "summary": "The standalone fix for CVE-2026-46300 is merged into the netdev tree (commit f84eca581739).",
      "sourceIds": [
        "oss-merged",
        "kernel-fix"
      ]
    },
    {
      "id": "dream-report",
      "occurredAt": "2026-10-27T12:00:00Z",
      "eventType": "first_observed",
      "summary": "Dream publishes artifacts showing a PHP2Shell plus Fragnesia chain rooted 25 servers, including a US government-affiliated network.",
      "sourceIds": [
        "dream"
      ]
    },
    {
      "id": "cisa-kev-add",
      "occurredAt": "2026-10-28T19:00:04Z",
      "eventType": "other",
      "summary": "CISA adds CVE-2026-46300 to KEV (catalog 2026.10.28), due 2026-10-31, forensic triage required.",
      "sourceIds": [
        "cisa-kev"
      ]
    },
    {
      "id": "hol-blog-published",
      "occurredAt": "2026-10-28T19:50:05Z",
      "eventType": "other",
      "summary": "HOL publishes operator guidance on checking page-cache tampering before reboot and patching.",
      "sourceIds": [
        "hol-blog"
      ]
    }
  ],
  "coverage": [
    {
      "assertionId": "guard-not-kernel",
      "relationship": "not_covered",
      "limitation": "HOL Guard reviews AI coding agent actions on developer machines. It does not patch kernels or inspect servers or appliances for page-cache tampering; the fix is a patched kernel or vendor firmware."
    }
  ],
  "policies": [],
  "limitations": [
    "Ubuntu 20.04 and older on their standard kernels are listed as not affected by Canonical",
    "Hosts that block the esp4 and esp6 modules cannot reach the vulnerable path",
    "Exploitation is local: an attacker needs code running on the host first",
    "Being patched for Dirty Frag (CVE-2026-43284, CVE-2026-43500) does not include the Fragnesia fix"
  ],
  "correctionHref": "/guard/security/campaigns/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root/corrections"
}