{"type":"bundle","id":"bundle--4855a2ab-b768-55d5-8e67-0f1d02e3052e","objects":[{"type":"campaign","spec_version":"2.1","id":"campaign--a19b30fc-51c9-51d8-806b-e6acbd3c3f56","created":"2026-10-28T19:58:31.620Z","modified":"2026-10-28T19:58:31.620Z","name":"Fragnesia (CVE-2026-46300): a Linux kernel bug that rewrites read-only files in memory, used to turn PHP2Shell web shells into root, now on CISA KEV","description":"CVE-2026-46300 (Fragnesia) is a Linux kernel local privilege escalation in the XFRM ESP-in-TCP path. skb_try_coalesce() moved page-cache-backed fragments between socket buffers without preserving the SKBFL_SHARED_FRAG marker, so ESP input decrypted them in place and XORed attacker-chosen AES-GCM keystream bytes into the page cache of read-only files. V12 disclosed it on 2026-05-13 with a public exploit that overwrites /usr/bin/su in memory; the fix (commit f84eca581739, 'net: skbuff: preserve shared-frag marker during coalescing') is in stable 7.0.10, 6.18.33, 6.12.91, 6.6.141, 6.1.174 and 5.15.208 and in distribution kernels. Dream reported on 2026-10-27 that attackers chained a custom PHP2Shell exploit with Fragnesia to root 25 servers, mostly firewall appliances, including systems on a US government-affiliated network, overwriting /etc/pam.d/su with pam_permit.so. CISA added it to KEV on 2026-10-28 with a 2026-10-31 due date and forensic triage required. The change lives in the page cache, not on disk, so a reboot or cache drop removes both the backdoor and the evidence.","aliases":["Fragnesia","CVE-2026-46300","Linux kernel Fragnesia","ESP-in-TCP page cache write","Dirty Frag variant","espintcp privilege escalation","PHP2Shell Fragnesia chain"],"first_seen":"2026-05-13T09:59:37Z","last_seen":"2026-10-28T19:50:05Z","objective":"Defensive public threat-intelligence record; see limitations and source references.","external_references":[{"source_name":"CISA KEV catalog entry for CVE-2026-46300","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-46300"},{"source_name":"NVD CVE-2026-46300","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-46300"},{"source_name":"oss-security: Linux kernel LPE (fragnesia)","url":"https://www.openwall.com/lists/oss-security/2026/05/13/3"},{"source_name":"oss-security: Hyunwoo Kim analysis and Dirty Frag mitigation","url":"https://www.openwall.com/lists/oss-security/2026/05/13/6"},{"source_name":"oss-security: Dirty Frag variants fix merged into netdev","url":"https://www.openwall.com/lists/oss-security/2026/05/21/11"},{"source_name":"Linux kernel commit f84eca581739: net: skbuff: preserve shared-frag marker during coalescing","url":"https://git.kernel.org/stable/c/f84eca5817390257cef78013d0112481c503b4a3"},{"source_name":"Dream Research: Chained PHP2Shell Exploit Roots 25 Servers","url":"https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers"},{"source_name":"Ubuntu CVE-2026-46300","url":"https://ubuntu.com/security/CVE-2026-46300"},{"source_name":"Debian security tracker CVE-2026-46300","url":"https://security-tracker.debian.org/tracker/CVE-2026-46300"},{"source_name":"HOL: Fragnesia CVE-2026-46300 is on CISA KEV","url":"https://hol.org/blog/cve-2026-46300-fragnesia-linux-kernel-cisa-kev-root"}]}]}