CISA added a Linux kernel privilege escalation flaw to its Known Exploited Vulnerabilities catalog on 28 October, after researchers documented it being chained with PHP2Shell to take full root on compromised servers.
What happened
The flaw is CVE-2026-46300, nicknamed Fragnesia, in the kernel's XFRM ESP-in-TCP path. When the kernel merges socket buffer fragments, it drops the flag that marks a page as shared with the file system. A local attacker can splice a readable file into a TCP socket, switch that socket into espintcp mode, and have the kernel decrypt attacker-chosen bytes straight into the page cache copy of that file.
That gives a deterministic one-byte write primitive with no race condition to win. V12 Security's William Bowling published the technique and a working proof of concept on 13 May 2026, writing a 192-byte stub over the cached copy of /usr/bin/su. The file on disk never changes, so sha256sum and file integrity tools still report it clean.
CISA's 28 October addition cites active exploitation, sets a 31 October remediation date and requires forensic triage rather than patching alone. Reporting on the campaign describes PHP2Shell getting the attacker a nobody-level process on a firewall appliance, with Fragnesia then used to reach root.
Who is affected
Any Linux host running a kernel built without the fix, from a small Ubuntu virtual machine to a firewall or appliance that ships its own kernel.
- Ubuntu, Debian, RHEL, AlmaLinux and other mainstream distributions that have not taken a kernel update since mid-2026
- Network and security appliances with an embedded Linux kernel, which are the platforms named in the reported chain
- Container hosts, where the page cache is shared and the escalation can cross a namespace boundary
- Systems where an attacker already holds a low-privilege account, a compromised web application process or a foothold in a container
What to do now
Patch the kernel, but collect evidence before you reboot. The corruption exists only in memory, so a restart destroys both the attacker's modification and the proof that it happened.
- Capture /proc/kallsyms comparisons, running processes, established outbound connections and any unusual su executions before restarting anything
- Update to a kernel build that includes commit f84eca581739 and reboot into it
- Where a patched kernel is not yet available, block the esp4, esp6 and rxrpc modules with a modprobe denylist if IPsec and AFS are not in use
- Hunt for the exploit's syscall signature: an unprivileged process calling unshare with both user and network namespaces, then setsockopt TCP_ULP espintcp, then execve on su
- Treat any host that has run an unpatched PHP web server as suspect, because this bug is the second half of that chain
What this means for South African businesses
Most South African SMEs never think about kernel versions, and the ones running a managed Ubuntu server or a virtualisation host usually patch applications and leave the kernel until the next rebuild. That habit is what makes this chain dangerous: an exposed PHP site patched at the application layer still hands an attacker a local shell that this flaw turns into root. The practical risk for an SME is low until something else on the box is compromised, and total once it is.
Read the technical detail in Tenable's Fragnesia FAQ.
Also on the blog
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.