Table of contents
17
Read this in 30 seconds: CVE-2026-46300, nicknamed Fragnesia, is a Linux kernel bug in how network buffers are merged. It lets a low-privileged local user write into the in-memory copy of files they cannot normally modify, which leads to root. CISA added it to the Known Exploited Vulnerabilities catalog on 28 October 2026 with a due date of 31 October, and flagged it for forensic triage.
- It is a local flaw, but local is not a comfort. The CVSS 3.1 score is 7.8 (High), yet an attacker who already has any foothold on a Linux host, such as a web shell, can use a bug like this to reach root.
- The fix is old, but the listing is new. The kernel patch was public by 13 May 2026, while CISA’s KEV entry dates from 28 October, and the sources do not say why it was listed now.
- CISA says it chains with the PHP bugs from last week. The KEV entry says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root, a claim we could not confirm elsewhere.
- Fixed kernels exist for most distributions. Ubuntu 22.04, 24.04 and 26.04 have fixed kernels, Ubuntu 20.04 and older are listed as not affected, and Red Hat lists RHEL 8, 9 and 10 as affected.
- You can mitigate without patching, at a cost. Red Hat’s bulletin offers blocking the IPsec modules, which breaks IPsec, or disabling unprivileged user namespaces, which can break rootless containers.
The lesson of CVE-2026-46300 is that a “local” kernel bug is a second stage, not a side issue. Once an attacker gets code running as any user on a Linux server, a reliable path to root turns a small breach into a full compromise.
This article covers what the flaw is, how it works at the level the kernel developers describe it, why CISA’s listing matters, which systems are exposed, how to fix or mitigate it, and how to check your own hosts. It does not include exploit code or step-by-step techniques.
Fragnesia is the name researchers gave CVE-2026-46300. Red Hat’s security bulletin RHSB-2026-003 places it in a group called Dirty Frag, which it also calls Copy Fail 2. The group covers flaws in the Linux kernel’s networking code, specifically the IPsec ESP modules (esp4 and esp6) and the rxrpc module that underpins the AFS file system.
Red Hat lists three CVEs in the set: CVE-2026-43284 (IPsec ESP), CVE-2026-43500 (rxrpc, which does not affect Red Hat products) and CVE-2026-46300 (Fragnesia, in how ESP-in-TCP handles socket buffers). All three are rated Important by Red Hat.
The name comes from the bug itself. According to Qualys, the kernel “forgets” that a fragment of memory is shared. William Bowling of the V12 security team found and reported it.
One point matters for patching. Qualys notes that Fragnesia targets the same part of the kernel as Dirty Frag but stems from a distinct logic flaw with a separate patch, so confirm that your kernel includes the CVE-2026-46300 fix specifically, not only the Dirty Frag fix.
The kernel’s own description, reproduced in the NVD record and on Ubuntu’s CVE page, is titled “net: skbuff: preserve shared-frag marker during coalescing.” It says that when the kernel merges network buffers, it can lose a marker that says some of the memory is shared with something else, such as the page cache that holds file contents.
The facts, and who said them:
The severity labels agree more than the weakness codes do.
| Source | Rating | Score |
|---|---|---|
| NVD | CVSS 3.1 | 7.8 High (AV:L/AC:L/PR:L/UI:N) |
| Red Hat | Important | 7.8 |
| Ubuntu | High priority, “trivial local privilege escalation” | 7.8 |
Red Hat explains the rating directly: it is Important rather than Critical because exploitation requires local access, but it needs no user interaction and can mean full compromise of confidentiality, integrity and availability.
We are describing CVE-2026-46300 at the level the kernel developers published. We are not reproducing an exploit, and we are leaving out the technique details that public write-ups contain.
When the kernel receives network data, it can merge buffers to be more efficient. Sometimes those buffers point at memory that belongs to something else, such as the cached copy of a file. The kernel marks such buffers as shared so that later code knows not to modify them in place.
According to the commit message, the merge function, skb_try_coalesce(), could move shared memory into a buffer without carrying the marker over. A later step in the ESP processing checks that marker before deciding whether it must first copy the data. With the marker gone, it could decrypt in place over memory that is backed by the page cache.
The upstream fix propagates the marker when the merge function transfers memory fragments.
In plain terms, a safety flag was dropped, so code that should have copied data before changing it changed the original. Ubuntu’s description of the consequence is that a local attacker could use it to escalate privileges, or possibly escape a container. Red Hat describes it as letting a low-privileged local attacker write arbitrary bytes into the page cache of read-only files, including sensitive system files, and so gain root.
One consequence deserves attention from responders. A change made to the page cache is a change in memory, not on disk, so in our reading checking files against package hashes on disk may not reveal it.
The KEV entry gives these facts: added 28 October 2026, due 31 October, forensic triage “Yes,” known ransomware use “Unknown,” weakness CWE-456, and a note that the issue affects an open-source component that other products can embed. The three-day deadline for CVE-2026-46300 is short, which signals that CISA treats it as urgent.
What the sources do not tell us is why the listing came five months after the patch. The Qualys write-up from 15 May 2026 carries “exploited in attacks” in its headline. The text we read describes research exploit code and its mechanics, not a named campaign or victim. Nothing in the sources we read names an attacker.
So the honest summary is: exploitation is confirmed by CISA, public exploit code exists, and the specifics of who is exploiting it are not public.
The forensic triage flag has a practical meaning. If you suspect a host was already targeted, preserve evidence before you reboot, because a reboot clears the page cache that may hold the only trace.
CISA’s KEV entry says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root. Those two are the PHP interpreter bugs we covered in PHP2Shell.
We could not confirm the chain independently. CISA’s text is the only source we found for it, and we did not see a campaign write-up that describes it. Treat it as CISA’s assessment, not as a confirmed incident pattern.
The logic of chaining CVE-2026-46300 is easy to follow, though. PHP2Shell gives an attacker code execution as the web server’s user. A local kernel bug like CVE-2026-46300 turns that into root. That is why a “local” flaw belongs on the same list as an internet-facing one. If your PHP servers are patched but your kernels are not, a single foothold can still go all the way.
You are exposed to CVE-2026-46300 if you run an unpatched Linux kernel in an affected range and an attacker can run code on the machine as any user. That includes shared hosts, CI runners, container hosts, developer boxes and any server with a web application that could be compromised first.
The NVD lists affected upstream versions by branch, with the first fixed kernel in each:
| Kernel branch | First fixed version (per NVD) |
|---|---|
| 5.10 | after 5.10.257 |
| 5.15 | 5.15.208 |
| 6.1 | 6.1.174 |
| 6.6 | 6.6.141 |
| 6.12 | 6.12.91 |
| 6.18 | 6.18.33 |
| 7.0 | 7.0.10 |
Distribution kernels often differ from upstream numbers, so check your vendor.
| Distribution | Status |
|---|---|
| Ubuntu 26.04 LTS | Fixed in 7.0.0-22.22 |
| Ubuntu 24.04 LTS | Fixed in 6.8.0-124.124 |
| Ubuntu 22.04 LTS | Fixed in 5.15.0-181.191 |
| Ubuntu 20.04 LTS and older | Listed as not affected |
| Red Hat Enterprise Linux 8, 9, 10 | Affected, with errata issued |
| OpenShift Container Platform 4.x | Fixed through RHCOS errata |
Two more details from the sources. Red Hat says any product that relies on its kernel, including RHEL CoreOS, OpenShift, OpenStack and Virtualization, is potentially affected, so the underlying host kernel must be current. And the NVD record also lists Siemens SIMATIC S7-1500 CPU 1518-4 PN/DP MFP firmware from 3.1.5 up to 3.1.6 among affected products, with two Siemens advisories in its references. We did not open those advisories.
To fix CVE-2026-46300, patch the kernel and reboot. A kernel update does not take effect until the host runs the new kernel.
Red Hat’s broader method blocks the IPsec modules. It will break IPsec, so check first whether you use it:
# Is IPsec in use? If nothing is loaded, it is safe to block the modules.
lsmod | grep -E 'esp4|esp6'
# Red Hat's mitigation (breaks IPsec functionality after the next reboot):
printf 'install esp4 /bin/false\ninstall esp6 /bin/false\n' > /etc/modprobe.d/dirtyfrag.conf
rmmod esp4 esp6 2>/dev/null; trueFor CVE-2026-46300, Red Hat’s alternative preserves IPsec by disabling unprivileged user namespaces, which can affect rootless containers, sandboxed browsers and Flatpak:
echo "user.max_user_namespaces=0" > /etc/sysctl.d/dirtyfrag.conf
sysctl --systemQualys’s advisory also recommends clearing the page cache after removing the affected modules. Read the full vendor guidance before applying any of this, because both mitigations change behaviour. They reduce risk but do not replace the patch.
These commands check state for CVE-2026-46300. None of them tests for the flaw.
# Running kernel (compare with the fixed versions above or your vendor advisory)
uname -r
# Is the IPsec ESP code loaded?
lsmod | grep -E 'esp4|esp6|rxrpc'
# Are unprivileged user namespaces enabled? (a value of 0 means disabled)
sysctl user.max_user_namespaces
# Was the Red Hat mitigation applied?
cat /etc/modprobe.d/dirtyfrag.conf 2>/dev/null
cat /etc/sysctl.d/dirtyfrag.conf 2>/dev/null
# Installed kernel packages
dpkg -l 'linux-image*' 2>/dev/null | grep '^ii'
rpm -q kernel 2>/dev/nullInterpret the results with care. A host can have a fixed kernel installed and still be running the old one until it reboots, so compare uname -r with the fixed version, not the package list.
If you suspect a host was already targeted, remember the page-cache point. Because the change lives in memory, comparing files on disk with package hashes may look clean. Preserve volatile evidence and logs first, then reboot, in line with the KEV forensic triage flag.
Most programmes treat kernel bugs as an operations problem and web bugs as a security problem. CVE-2026-46300 shows why that split fails: the web bug gets the attacker in, and the kernel bug decides how far they get.
In an AI-assisted VAPT engagement, we test that second step on authorised systems. We check whether a foothold on a web server could be escalated: which kernels the hosts run, whether unprivileged user namespaces are enabled, and how well containers are isolated from the host, as in our cloud infrastructure testing methodology. We report findings with fix steps and re-test once you have patched.
For teams that run their own scans, our guide to AI vulnerability scanning and remediation covers what automated tools find and miss. A pentest report does not certify that you are safe from this CVE. It records what was tested at a point in time, and you should still patch and verify the running kernel yourself.
Yes. CISA added CVE-2026-46300 to its KEV catalog on 28 October 2026 with a due date of 31 October, and public exploit code has existed since at least May. We could not find a source that names the attackers or describes a specific campaign.
No. It is a local privilege escalation, so the attacker needs to run code on the machine first. That is why it matters most on servers that already face other risks, such as a web application that could be compromised and give a low-privileged foothold.
The NVD lists first fixed upstream versions of 5.15.208, 6.1.174, 6.6.141, 6.12.91, 6.18.33 and 7.0.10, with 5.10 fixed after 5.10.257. Ubuntu fixed 22.04 in 5.15.0-181.191, 24.04 in 6.8.0-124.124 and 26.04 in 7.0.0-22.22, and lists 20.04 and older as not affected.
Possibly. Ubuntu says a local attacker could use it to escalate privileges or possibly escape a container, and Red Hat says its kernel-based products, including OpenShift, need an updated host kernel. Containers share the host kernel, so patch the host, not just the images.
Red Hat’s bulletin gives two options: block the IPsec modules esp4 and esp6, which breaks IPsec, or disable unprivileged user namespaces, which can break rootless containers and sandboxed apps. Both reduce risk but do not replace a kernel update.
CISA’s KEV entry says it can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP web shells and run commands as root. We could not confirm that independently, but the idea is simple: the PHP bugs can provide a foothold and this kernel bug can provide root.
CVE-2026-46300 is a kernel bug with a modest score and an urgent deadline. It needs local access, but CISA lists it as exploited, public exploit code exists, and a three-day due date says the agency is not treating it as routine.
The next step is concrete. Find which Linux hosts run affected kernels, patch and reboot the ones that run untrusted code first, apply Red Hat’s mitigation where you cannot, and preserve evidence before rebooting anything you suspect was already touched.
Categories
Related articles
