Fragnesia, tracked as CVE-2026-46300, is a Linux kernel vulnerability that lets any local user rewrite the in-memory copy of a read-only file and take root. It is now being used in the wild to finish off firewalls compromised through PHP2Shell. CISA added it to the KEV catalog on October 28, 2026 with a due date of October 31 and a forensic triage flag. If you run Linux servers or appliances that serve anything to the internet, patch the kernel this week, and collect evidence before the reboot that the patch needs.
When we wrote up PHP2Shell on October 22, we flagged the firewalls and other appliances that bundle their own PHP and were not fixed in the first day. Four days later a research team showed exactly that, with Fragnesia as the second half of the chain. This post covers why the kernel half matters, and why the order in which you respond to it matters even more.
What happened
Fragnesia is not new. William Bowling of V12 disclosed it on May 13, 2026 with a public proof of concept, and the CVE identifier was announced on oss-security the same day. On May 21 the fix was split into its own netdev patch, separate from the related Dirty Frag fixes. When Tenable reviewed it a day later, it was a local privilege escalation with a working exploit and no reported exploitation in the wild.
That changed with a report from Dream Research, published October 26. Dream recovered the tooling of an operation that chained a custom PHP2Shell build with Fragnesia against the management interface of one large vendor’s firewall software. Dream did not name the vendor and says it notified them.
- October 8, 2026: the campaign setup begins, per Dream’s timeline.
- October 23, 18:14 UTC: a government-affiliated firewall is rooted during an automated batch, then crashes and never returns.
- October 24, 10:09 UTC: a second firewall from the same organization is rooted; at 11:35 UTC the internal firewall management server falls through a reverse SSH tunnel.
- October 25: Dream finds the artifacts; it publishes the next day.
- October 28: CISA lists CVE-2026-46300 on KEV.
The funnel in the recovered logs shows how cheap the targeting was. The attacker found about 19,000 exposed firewalls through FOFA, got a version back from about 5,000 of them, filtered to the US, Japan, Taiwan and South Korea, and fed 240 targets to a batch runner.
Twenty-two of the rooted firewalls were left parked with a 103-byte PHP webshell. Dream ties the operation to a China-nexus actor through targeting, tooling and time zone, without naming a group.
Which Linux kernels are affected
NVD lists vulnerable kernels from 3.9 onward, with fixes in the stable branches below. NVD shows no fixed release for the 5.10 branch, which it lists as vulnerable through 5.10.257.
| Branch | Fixed in |
|---|---|
| 5.15 | 5.15.208 |
| 6.1 | 6.1.174 |
| 6.6 | 6.6.141 |
| 6.12 | 6.12.91 |
| 6.18 | 6.18.33 |
| 7.0 | 7.0.10 |
Distribution kernels carry backports, so check your vendor’s package version rather than the upstream number. Ubuntu fixed it in 7.0.0-22.22 for 26.04 LTS, 6.17.0-35.35 for 25.10, 6.8.0-124.124 for 24.04 LTS and 5.15.0-181.191 for 22.04 LTS, and lists 20.04 LTS and older as not affected. AlmaLinux shipped kernel-5.14.0-611.54.4.el9_7 for version 9, and Amazon Linux is not affected because it does not ship the espintcp module. The CVSS 3.1 score is 7.8 from both NVD and Red Hat, and Red Hat rates it Important because the attacker needs local access. On a firewall whose web interface hands out that local access to anyone, the rating undersells it.
How Fragnesia works
The bug sits in how the kernel merges socket buffers. According to the kernel fix, skb_try_coalesce() can move page fragments that belong to the page cache into another buffer without carrying the flag that marks them as shared. ESP input checks that flag before it decides whether it may decrypt in place, so it ends up decrypting directly over file pages.
The disclosure describes the result as arbitrary byte writes into the page cache of read-only files, with no race condition. The attacker splices a file into a TCP socket, switches the socket to ESP-in-TCP mode, and picks the nonce so that the AES-GCM keystream sets one chosen byte per trigger. Tenable notes the exploit gets the network capability it needs through user and network namespaces, which most distributions enable by default.
The detail that shapes your response is where the change lives. The on-disk file never changes, and Tenable notes that a reboot or cache flush restores normal behavior. In the firewall campaign, PHP2Shell gave the attacker code execution as nobody, which SELinux kept away from system files. Fragnesia then rewrote /etc/pam.d/su in memory to accept everyone through pam_permit.so, so su root worked without a password. Dream says the whole chain ran from one unauthenticated request to a persistent root webshell in under 15 minutes.
So the kernel evidence evaporates at the next reboot, while everything the attacker built with root (the webshell, a systemd tunnel service, an rc.local hook) sits on disk and survives it. We think that asymmetry is the real lesson of this KEV entry.
How to detect Fragnesia exploitation
A file-change watcher keyed on writes will not fire here, because no process ever writes to the file. What you can see is its use. A web service account calling su has no business reason on a server or appliance, and in this chain it is the moment the tampered PAM file pays off. The Sigma rule below maps to T1068 and T1556.003.
Data source: Linux process creation events (auditd, Sysmon for Linux or EDR), Sigma linux process_creation category
title: Su Executed By Web Service Account
id: 3f6c2a91-8d47-4b1e-9c5a-7e2d4f8b6a13
status: experimental
description: Detects su launched by a web server service account, the step where a Fragnesia (CVE-2026-46300) page-cache overwrite of /etc/pam.d/su turns web code execution into root.
references:
- https://dreamgroup.com/blog/chained-php2shell-exploit-roots-25-servers
- https://www.openwall.com/lists/oss-security/2026/05/13/5
author: MarkCyber Research
date: 2026-10-29
tags:
- attack.privilege-escalation
- attack.t1068
- attack.credential-access
- attack.t1556.003
- cve.2026-46300
logsource:
product: linux
category: process_creation
detection:
selection:
Image|endswith: '/su'
User:
- 'nobody'
- 'apache'
- 'www-data'
- 'nginx'
condition: selection
falsepositives:
- Admin scripts run by the web server that call su on purpose; there should be almost none, so allowlist them by full command line
level: highThe rule only sees appliances that ship process telemetry, which many firewalls do not, and an attacker who overwrites a different binary or file will not trip it. On a box you can reach, check four things before anything else. Run grep pam_permit /etc/pam.d/su and compare the PAM files against your package database (rpm -V pam or debsums pam); on a live system those reads see the tampered memory copy. Check lsmod for esp4, esp6 or espintcp on hosts that run no IPsec, and look for unfamiliar systemd units, rc.local entries and outbound SSH sessions. Hunt back to October 8, 2026, the start of the campaign.
Mitigation
- Collect before you reboot. CISA’s forensic triage steps tell agencies to acquire volatile data first and not to remediate before collection where possible. For Fragnesia that is literal, since the tampered page cache is gone after the reboot. Take a memory image and copies of the PAM files on any exposed host first, then patch.
- Patch the kernel and reboot. Install your distribution’s fixed kernel and confirm the running version with
uname -r. The Dirty Frag kernel patches do not fix Fragnesia. For appliances, only the vendor’s firmware brings a fixed kernel, so follow its advisory and keep the management interface off the internet in the meantime. Working out which exposed systems carry which kernel and PHP is the kind of gap our security engineering work closes. - If you cannot patch yet, unload and block the modules with
rmmod esp4 esp6 rxrpcand aninstall <module> /bin/falseline for each in/etc/modprobe.d/, per Tenable’s write-up of the Dirty Frag mitigation. Ubuntu warns that this breaks IPsec, including StrongSwan VPNs, and AFS. Hyunwoo Kim, who fixed the Dirty Frag variants, advises keeping the mitigation in place because more ESP variants are expected.
Bottom line
Image memory and copy the PAM files on every internet-facing Linux host and appliance, then patch the kernel and reboot before October 31. Treat any firewall that exposed its management interface since October 8 as suspect until you have checked it for webshells, tunnels and su calls from the web user.