The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-46300, a high-severity Linux kernel privilege-escalation flaw known as Fragnesia, to its Known Exploited Vulnerabilities catalog. The October 28 listing warns that attackers can chain the flaw with two PHP2Shell vulnerabilities to plant PHP webshells and run commands as root. U.S. federal civilian agencies have been given until October 31, 2026, to remediate the issue.
Tracked as CVE-2026-46300, Fragnesia affects the Linux kernel’s XFRM ESP-in-TCP networking subsystem. Red Hat’s security advisory describes it as a local privilege-escalation vulnerability that can let a low-privileged user write arbitrary data into the page cache of read-only files, including sensitive system files. An attacker could use that behavior to overwrite privileged binaries and gain root access. The flaw carries a CVSS 3.1 score of 7.8.
Fragnesia is related to the broader Linux page-cache privilege-escalation issue known as Dirty Frag, but it is tracked under a separate CVE. The important development is its use alongside PHP2Shell, tracked as CVE-2026-109618 and CVE-2026-109619. The PHP flaws can provide the initial remote code-execution foothold, while Fragnesia can then raise privileges from a low-privileged account to root. The PHP2Shell vulnerabilities have already been added to CISA’s exploited vulnerabilities catalog.
Dream Research says it uncovered a campaign that used a custom PHP2Shell exploit together with Fragnesia to gain root access on 25 servers across the United States, Japan, Taiwan and South Korea. Its October 26 report says three of the affected systems were part of a U.S. government-affiliated environment. Researchers said they recovered exploitation logs, target lists and around 40 post-exploitation scripts. Dream did not identify the firewall vendor involved.
Red Hat says fixes are available for affected products and provides mitigation guidance for Red Hat Enterprise Linux and OpenShift environments. Its security bulletin warns that blocking the affected ESP modules can disrupt IPsec functionality, so administrators should follow the instructions for their specific Linux distribution and products.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
