Fragnesia: the Linux kernel flaw CISA says can be chained with PHP2Shell to root
Fragnesia is the name distributors use for a Linux kernel flaw that lets a local user become root. CISA lists it as exploited and says it can be chained with the two PHP2Shell flaws. Each statement below links to its official source, with the quoted text one click away. The commands only print information on your own machine.
Facts last checked against the stored sources on
What happened
-
CISA added CVE-2026-46300 to its Known Exploited Vulnerabilities catalog on , listing it under the name Linux Kernel Missing Initialization of a Variable Vulnerability. The catalog lists as the due date.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
"cveID": "CVE-2026-46300", "vendorProject": "Linux", "product": "Kernel", "vulnerabilityName": "Linux Kernel Missing Initialization of a Variable Vulnerability", "dateAdded": "2026-10-28",
"dueDate": "2026-10-31",
-
The catalog entry says the vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root. Those two are the PHP2Shell flaws.
Source: CISA Known Exploited Vulnerabilities catalog · Event page: PHP2Shell
Quoted text
This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
-
The catalog entry marks forensic triage as required. Its required action refers to CISA's Forensics Triage Requirements.
Source: CISA Known Exploited Vulnerabilities catalog
Quoted text
"forensicTriage": "Yes",
ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).
-
The Ubuntu Security Team says the flaw in the XFRM ESP-in-TCP subsystem of the Linux kernel is known as Fragnesia, and that a local attacker could use it to escalate privileges or possibly escape a container.
Source: Ubuntu Security Team
Quoted text
It was discovered that a logic flaw existed in the XFRM ESP-in-TCP subsystem in the Linux kernel when handling socket buffer fragments. This flaw is known as Fragnesia. A local attacker could use this to escalate privileges, or possibly escape a container.
-
Red Hat's CVE page tracks the same flaw under the name Fragnesia and says a low-privileged local attacker can gain root privileges by overwriting sensitive system files. It points to Red Hat security bulletin RHSB-2026-003 for the mitigation procedure.
Source: Red Hat Product Security
Quoted text
A low-privileged local attacker can exploit this flaw in the Linux kernel's XFRM ESP-in-TCP subsystem to gain root privileges by overwriting sensitive system files.
Security Bulletin https://access.redhat.com/security/vulnerabilities/RHSB-2026-003
kernel: "Fragnesia" is a variant of Dirty Frag vulnerability in the ESP/XFRM leading to Local Privilege Escalation (LPE) vulnerability in the Linux kernel
Affected and fixed kernel versions
Kernel versions come from the CVE record written by the Linux kernel CNA. Distributions backport fixes, so the version a distribution lists can differ from the upstream one; for a distribution kernel use the distribution's own table below. Vendors that are not listed here are not covered by this page.
-
The CVE record lists the Linux kernel as affected from 3.9. Kernels before that version are listed as unaffected.
Source: CVE Program (record by the Linux kernel CNA)
Quoted text
{ "version": "3.9", "status": "affected" }
{ "version": "0", "lessThan": "3.9", "status": "unaffected", "versionType": "semver" }
-
The CVE record lists these upstream stable releases as unaffected, that is, as carrying the fix: 5.10.257 in the 5.10 series, 5.15.208 in 5.15, 6.1.174 in 6.1 and 6.6.141 in 6.6.
Source: CVE Program (record by the Linux kernel CNA)
Quoted text
{ "version": "5.10.257", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }
{ "version": "5.15.208", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }
{ "version": "6.1.174", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }
{ "version": "6.6.141", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }
-
It lists 6.12.91 in the 6.12 series, 6.18.33 in 6.18 and 7.0.10 in 7.0 as unaffected, and the 7.1 release as unaffected too.
Source: CVE Program (record by the Linux kernel CNA)
Quoted text
{ "version": "6.12.91", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver" }
{ "version": "6.18.33", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver" }
{ "version": "7.0.10", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver" }
{ "version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" }
-
For its generic linux kernel package, Ubuntu lists the fixed versions 7.0.0-22.22 for 26.04 LTS, 6.17.0-35.35 for 25.10, 6.8.0-124.124 for 24.04 LTS and 5.15.0-181.191 for 22.04 LTS. It lists 20.04 LTS and 26.10 as not affected for that package; other kernel packages have their own rows, as the next statement shows.
Source: Ubuntu Security Team
Quoted text
linux 26.10 stonking Not affected 26.04 LTS resolute Fixed in 7.0.0-22.22 25.10 questing Fixed in 6.17.0-35.35 24.04 LTS noble Fixed in 6.8.0-124.124 22.04 LTS jammy Fixed in 5.15.0-181.191 20.04 LTS focal Not affected
-
The Debian Security Tracker lists the fixed source package versions 5.10.257-1 for bullseye (advisory DLA-4606-1), 6.1.174-1 for bookworm (advisory DSA-6306-1) and 6.12.90-1 for trixie (advisory DSA-6295-1).
Source: Debian Security Tracker
Quoted text
linux source bullseye 5.10.257-1 DLA-4606-1 linux source bookworm 6.1.174-1 DSA-6306-1 linux source trixie 6.12.90-1 DSA-6295-1
-
On Ubuntu 20.04 LTS the generic linux package is not affected, but the hardware enablement kernel package linux-hwe-5.15 is listed as fixed in 5.15.0-181.191~20.04.1, with the fix available through Ubuntu Pro.
Source: Ubuntu Security Team
Quoted text
linux-hwe-5.15 26.10 stonking Not in release 26.04 LTS resolute Not in release 25.10 questing Not in release 24.04 LTS noble Not in release 22.04 LTS jammy Not in release 20.04 LTS focal Fixed in 5.15.0-181.191~20.04.1 Ubuntu Pro Fix available with Ubuntu Pro .
-
The CVE record carries Red Hat's own data. It lists the kernel package versions 0:6.12.0-211.16.1.el10_2 for Red Hat Enterprise Linux 10, 0:6.12.0-55.75.1.el10_0 for Red Hat Enterprise Linux 10.0 Extended Update Support and 0:4.18.0-553.125.1.el8_10 for Red Hat Enterprise Linux 8 as unaffected, that is, as carrying the fix.
Source: CVE Program (record by the Linux kernel CNA; Red Hat data)
Quoted text
"product": "Red Hat Enterprise Linux 10", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:6.12.0-211.16.1.el10_2", "versionType": "rpm" } ]
"product": "Red Hat Enterprise Linux 10.0 Extended Update Support", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:6.12.0-55.75.1.el10_0", "versionType": "rpm" } ]
"product": "Red Hat Enterprise Linux 8", "vendor": "Red Hat", "versions": [ { "lessThan": "*", "status": "unaffected", "version": "0:4.18.0-553.125.1.el8_10", "versionType": "rpm" } ]
-
SUSE marks the kernel-default package as released for SUSE Linux Enterprise Server 15 SP7 and SUSE Linux Enterprise Server 16.0, and as still affected for SUSE Linux Enterprise Server 15 SP1-LTSS. SUSE's table gives fixed package versions per product; this page does not repeat them.
Source: SUSE
Quoted text
SUSE Linux Enterprise Server 15 SP7 kernel-default Released
SUSE Linux Enterprise Server 16.0 kernel-default Released
SUSE Linux Enterprise Server 15 SP1-LTSS kernel-default Affected
Check whether a host is already compromised before you patch
The commands below only read. They do not change the host, and finding nothing with them does not prove a host is clean. CISA's guidance is to collect evidence first and to patch after that, because patching or restarting can destroy it.
-
CISA's forensic triage guidance says not to alter or remediate systems before evidence is collected when possible, and to begin evidence analysis to determine whether a compromise occurred.
Source: CISA (BOD 26-04 implementation guidance)
Quoted text
Do not alter or remediate systems prior to evidence/artifact collection when possible.
Begin evidence analysis to determine if a compromise occurred.
-
The same guidance warns that containment started too early can destroy vital evidence, and says to isolate impacted and suspected impacted systems.
Source: CISA (BOD 26-04 implementation guidance)
Quoted text
Premature containment can destroy vital evidence.
Isolate impacted and suspected impacted systems and network infrastructure.
These commands run on your own machine and only read what is installed there: versions, issuers, validity dates and trust-store entries. PatchBell does not scan your systems.
Linux
Prints the release of the kernel that is running on this host. Compare it with the fixed versions above.
uname -rTool documentation: Debian manpages (coreutils)
Quoted text
-r , --kernel-release print the kernel release Linux (web root)
Lists PHP files under the web root that were modified in the last 10 days, which reaches back to the week PHP2Shell was disclosed, with their owner and time. It only reads. Replace the path with your own web root.
find /var/www -type f -name '*.php' -mtime -10 -lsTool documentation: Debian manpages (findutils)
Quoted text
-mtime n File's data was last modified less than, more than or exactly n *24 hours ago.-name pattern Base of file name (the path with the leading directories removed) matches shell pattern pattern .-ls True; list current file in ls -dils format on standard output. - List the Linux hosts that run PHP applications, and the hosts where users other than administrators can run code. The chain CISA describes needs both PHP and this kernel flaw.
- On each host, read the kernel release with the first command below and compare it with the tables above. For a distribution kernel use the distribution's table, not the upstream one.
- Before you patch or restart, copy the web server logs, the authentication logs and the output of the commands below to a place off the host. A restart discards memory and anything that lived only in it.
- List the PHP files under each web root that changed recently, with the second command below (change the path to your web root), and compare the list with your last deployment. A PHP file you did not deploy needs an explanation.
- Look in the authentication logs for logins and for commands run as root that nobody on your team can account for.
- If anything is unexplained, isolate the host and escalate it as an incident instead of deleting files. Rebuild from a known-good source once the evidence is kept.
- Then install the fixed PHP release for PHP2Shell, which the PHP2Shell event page lists, and the fixed kernel from your distribution, and restart into the new kernel.